Privacy Policy

Enclave is a secrets management platform built and operated by Ankit Bhavarthe (“we”, “our”, or “us”). Our platform is accessible at https://enclave.ankitbhavarthe.xyz. By using Enclave, you agree to this Privacy Policy.

We collect the minimum information necessary to provide the service:

• Account information — When you sign in via Google or GitHub OAuth, we receive your email address, display name, and profile avatar URL from the OAuth provider. We do not collect or store passwords.
• Usage data — Actions you perform within the platform (pushing, pulling, reverting secrets) are recorded in an immutable audit log tied to your account.
• Technical data — IP address and User-Agent string are used for session fingerprinting to protect your account against session hijacking. These are never persisted to the database; they are used only in-memory per request.
• CLI tokens — When you authenticate via the CLI, a Personal Access Token (PAT) is generated and stored as a one-way SHA-256 hash in our database. The raw token is displayed to you once and is never stored in plaintext.

We do not collect any payment information, phone numbers, or physical addresses.

• To authenticate you and provide access to your projects and secrets.
• To enforce access controls (RBAC) within your projects.
• To send team invitation emails via Resend when a project owner invites you.
• To maintain audit logs that allow your team to track changes to secrets — a core security feature of the platform.
• To prevent abuse through rate limiting on authentication endpoints.

We do not sell your data, share it with advertisers, or use it for marketing purposes.

All data is stored in a PostgreSQL database hosted on a single Amazon EC2 instance. Secret values are never stored in plaintext. We use envelope encryption (AES-256-GCM):

• A 256-bit master key lives only in the server's environment variables and is never written to the database.
• Each project has a unique data key, encrypted by the master key, stored in the database.
• Each secret version is encrypted with the project's data key, producing a ciphertext, a nonce, and a GCM authentication tag — all stored together.

Access tokens (JWT) are stored in HttpOnly, Secure cookies. Refresh tokens are stored as random 40-byte hex strings in Redis with a 7-day TTL. Refresh tokens are immediately revoked on logout.

We use a limited number of third-party services, each with a specific purpose:

• Google OAuth — Used for sign-in. Governed by Google's Privacy Policy.
• GitHub OAuth — Used for sign-in. Governed by GitHub's Privacy Statement.
• Resend — Used to send transactional invitation emails. Only your email address is shared with Resend for this purpose. Governed by Resend's Privacy Policy.
• Amazon Web Services (AWS) — Our EC2 server and infrastructure run on AWS. No personal data is shared directly with AWS beyond what passes through the server.
• Vercel — Hosts the frontend. Governed by Vercel's Privacy Policy.

We use the following cookies:

• access_token — An HttpOnly, Secure JWT cookie with a 15-minute lifespan. Used to authenticate API requests from the browser.
• refresh_token — An HttpOnly, Secure cookie with a 7-day lifespan. Used to silently obtain a new access token without re-authentication.
• oauth_state — A short-lived (10-minute) CSRF protection cookie set during the OAuth flow. Immediately cleared after the flow completes.

We do not use advertising cookies, tracking pixels, or analytics cookies. No data is shared with third-party advertising networks.

We retain your account data (email, name, avatar) for as long as your account is active. Project data, secret versions, and audit logs are retained indefinitely unless you delete the project.

You can delete your account and all associated data by contacting us at ankit@ankitbhavarthe.xyz. We will process deletion requests within 30 days.

You have the right to:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request corrections to inaccurate data.
• Deletion — Request deletion of your account and all associated data.
• Portability — Request a machine-readable export of your data.

To exercise any of these rights, contact us at ankit@ankitbhavarthe.xyz.

Enclave is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately so we can delete it.

We may update this Privacy Policy from time to time. When we make significant changes, we will update the “Last updated” date at the top of this page. Your continued use of Enclave after changes are posted constitutes your acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out:

• Email: ankit@ankitbhavarthe.xyz
• Website: ankitbhavarthe.xyz