HugeCrypt Privacy Notice

1. Information we collect or may collect

HugeCrypt currently collects or may collect the following categories of information, depending on how you use the service:

• Account information: display name, email address, password hash, role, account status, verification state, quota values, login/session records, and account-deletion/de-identification markers.
• Registration and verification data: pending signup details, verification PIN state, resend/manual verification requests, timestamps, and admin review markers.
• Job and vault data: job UID, mode, status, timestamps, quota use, processing server routing, queue information, vault JSON files, metadata needed to decrypt, and result files that may be temporarily stored for download and troubleshooting.
• Generated secret behavior: plaintext secrets are intended to be shown once and not stored inside vault JSON files. However, transient processing may occur in server memory while the pipeline completes and the claim window remains open.
• Payment data: payment order ID, capture/transaction ID, payment status, amount, currency, local reference, and payment notification/return payloads. HugeCrypt does not store full card credentials or payment account login credentials.
• Support messages: name, email, subject, message, account role, user ID, and related timestamps for admin review.
• Technical and security data: IP address, user agent, browser details, device/session data, server logs, errors, abuse/fraud indicators, rate-limit data, queue/load data, and diagnostic telemetry.
• Browser-local preferences: theme choice and similar UI settings stored in browser localStorage or cache.

HugeCrypt may later collect additional operational, diagnostic, analytics, security, anti-abuse, or improvement data if needed to protect users, improve reliability, investigate failures, detect misuse, comply with legal obligations, or improve the experimental pipeline.

2. Vault JSON storage and user responsibility

For privacy and convenience, HugeCrypt stores vault JSON files on the server or related cloud/dataset storage for an amount of time until they are no longer required by the user, deleted, de-identified, or HugeCrypt storage requires more memory. Storage duration is not guaranteed.

Vault files may be retained, pruned, migrated, overwritten, de-identified, or deleted for storage, security, abuse prevention, maintenance, account deletion, or operational reasons. Users should keep independent backups of vault files, PINs, generated secrets, and recovery instructions.

3. How information is used

• To create, verify, secure, administer, suspend, activate, downgrade, or delete/de-identify accounts.
• To run encryption/decryption jobs, route jobs to processing servers, show results, enforce quotas, and process support/debug requests.
• To process Pro upgrades through a payment processor and prevent duplicate or fraudulent payment events.
• To send verification PINs, support replies, account notices, security notices, and payment notifications.
• To detect spam, abuse, unauthorized access, malicious activity, scraping, overload, payment fraud, and infrastructure attacks.
• To improve HugeCrypt’s reliability, reproducibility, documentation, user experience, models, diagnostics, and server planning.
• To comply with legal, accounting, tax, security, audit, dispute, and platform-provider obligations.

4. Service providers and disclosures

HugeCrypt may process or disclose information through third-party providers and infrastructure needed to operate the service, including hosting, email, database, payment, processing, analytics/security, and support tools. A third-party payment processor processes payment approvals and captures. HugeCrypt does not receive or store your complete payment account credentials or card details.

HugeCrypt may disclose information if required to comply with law, respond to lawful requests, enforce terms, protect users, investigate abuse, defend rights, resolve payment disputes, or prevent harm.

5. Retention, deletion, and de-identification

HugeCrypt retains personal information only as long as reasonably necessary for account operation, job processing, vault convenience, support, payment records, security, legal compliance, dispute handling, diagnostics, or service improvement. Vaults and logs may be retained for varying periods depending on storage availability and operational need.

When a user deletes an account, HugeCrypt de-identifies the user record rather than hard-deleting every related database row. This helps preserve service integrity, fraud controls, payment records, job history consistency, support history, and audit trails while reducing personal identifiability.

Backup copies, server logs, payment records, abuse records, or legally required records may remain for a period even after deletion/de-identification, subject to operational and legal constraints.

6. Security and account compromise

HugeCrypt uses reasonable technical and organizational safeguards, but no internet-connected experimental service can guarantee absolute security. Users must protect passwords, devices, browser sessions, vault downloads, PINs, and support communications.

If someone gains access to your account, PIN-protected vaults are safer than vaults generated without a PIN. However, HugeCrypt cannot guarantee that vaults, account activity, or downloads are safe after compromise. Contact support immediately if compromise is suspected.

7. Privacy rights

Depending on applicable law, you may request access, correction, deletion/de-identification, restriction, objection, portability, or information about how your data is processed. HugeCrypt may verify your identity before acting on requests and may decline or limit requests where retention is required for legal, security, payment, fraud, dispute, or operational reasons.

Privacy requests can be sent through HugeCrypt Support.

8. Contact and updates

Questions about privacy, account deletion, support messages, vault storage, payments, or security can be sent through HugeCrypt Support.

HugeCrypt may update this Privacy Notice as the service evolves, including if new data categories, safeguards, or operational workflows are introduced.

This privacy notice is a protective operational draft and should be reviewed by qualified counsel before being treated as final legal advice.