Skip to main content

Use arrow keys to navigate, Enter to select, Escape to close menu.

ZeyroVault

What Happens to Your Data After You Close the Tab?

Nothing is uploaded, so there is no server-side copy to expire or delete. Retention here means what your browser and your own downloads keep. This page separates those layers.

The Server Never Receives the Payload

No upload, no stored ciphertext

The tools run as static files in your browser. When you type a message or select a file, the input stays in memory on your device. AES-256-GCM, specified in NIST SP 800-38D, runs through the Web Crypto API before any output exists.

That design removes the retention question most services have to answer. There is no encrypted object, no access token and no expiry timer on a server, because there is no upload step. The only data that reaches our infrastructure is ordinary request metadata such as IP address, timestamp and response code.

Try it: encrypt a note, then inspect the request body in the Network tab.

  • Not received: plaintext, passphrases, keys or encrypted output
  • Received: standard request metadata processed by the hosting provider
  • Stored by us: nothing tied to the content you encrypt

What Stays on Your Device

Browser memory, downloads and preferences

During a session, the input and the derived key live in the memory of the page. Closing the tab or reloading the page discards them. If you download the encrypted output, that file becomes yours to keep, move or delete.

The browser also keeps a small amount of local state so the site works predictably. That includes your theme choice, your language and cached application files for offline use. It does not include the text or files you processed.

Try it: close the tab without saving, then reopen the tool and look for the note.

  • Session memory: cleared when the page is closed or reloaded
  • Downloads: stored wherever your browser saves files, until you delete them
  • Preferences and cache: kept by the browser until you clear site data

How to Remove Local Traces

A short checklist

Because the data is yours, deletion is also yours. Start with the files you saved: remove the downloaded ciphertext from your downloads folder and from any backup or sync service that copied it. Then clear the site data in your browser if you want to reset preferences and cached files.

If you shared the encrypted output with someone else, deleting your copy does not delete theirs. A shared file is a separate copy under the recipient's control.

Try it: clear site data for this domain, then confirm the theme resets.

  • Delete downloaded ciphertext from every device and sync folder you used
  • Clear site data in the browser to remove preferences and cached files
  • Ask recipients to delete copies you shared, since you cannot reach them yourself

What Hosting Logs Record

Metadata with a short life

Our hosting provider processes request logs so the site can be served and protected. Those logs can include an IP address, a timestamp, the requested path, a user agent and a response code. They do not include the content you typed, because that content never travels in a request.

Logs are operational data, not a content archive. Retention follows the hosting provider's policy, and we describe the current window in the privacy policy. Aggregate statistics on this site are cookie-free and off by default.

Try it: open DevTools and note which request headers your browser sends.

  • Request logs: short-lived operational data held by the hosting provider
  • No payload logging: the request body never contains your input
  • Statistics: aggregate, cookie-free and off by default on this site

Erasure Requests When Nothing Was Uploaded

What a controller can and cannot delete

A GDPR erasure request asks a controller to delete the personal data it holds about you. Here that means request metadata that can be linked to you, not encrypted files. We can remove log records within the provider's retention window and explain what remains outside our control.

We cannot delete a file we never received, and we cannot confirm the deletion of content we cannot see. That is a limit of the architecture, not a refusal. Keep your own record of where you saved a file and when you deleted it.

Try it: write down which data you actually sent, then compare it with this list.

  • Ask us to remove request records tied to your IP address or correspondence
  • Delete files you saved yourself, since those copies are outside our reach
  • Treat any promise to delete unseen plaintext as a misunderstanding of the model

Data Retention Questions

Is any encrypted file stored on your servers?

No. The tools do not upload your input or the encrypted output. There is no server-side object, token or expiry timer to manage.

What happens when I close the tab?

The page's memory is released, so unsaved input and the derived key are gone. Files you downloaded stay where you saved them until you delete them.

Can you delete data I saved on my device?

No. We have no access to your device or your downloads. Use your browser's site-data controls and your file manager, and ask anyone you shared a copy with to delete it too.

Related guides on keys and privacy

Encrypt Without Leaving a Server Copy

Keep the key and the ciphertext on your own devices. Nothing is uploaded while you work.

Open the encryption tools
See what the tools deliberately cannot doBrowse all tools