Privacy Policy

At Digital Graffiti LLC, privacy is not a feature or a compliance checkbox—it is our fundamental architecture. We believe software should serve its user without converting the user into data to be harvested.

Digital Graffiti LLC operates zero proprietary servers, user databases, or cloud backends. Your sensitive credentials, encryption keys, and personal data remain under your direct control at all times.

SpyVault™ is designed for a seamless, encrypted multi-device experience while preserving complete user ownership:

• Default Google Drive Sync (Your Cloud, Not Ours): By default, SpyVault syncs your end-to-end encrypted vault across your personal devices using your own Google Drive account. The vault is stored exclusively in Google Drive's sandboxed appDataFolder, isolating it from other apps. Digital Graffiti LLC does not operate any intermediary servers or store any copy of your vault.
• Portable Mode (Fully Offline): Users who prefer complete offline isolation can enable Portable Mode. In Portable Mode, the encrypted vault lives right alongside the executable on a USB drive or local directory, with zero cloud connections required.

We practice strict data minimization across all our applications:

• No Usage Analytics: We do not track your behavior, feature interactions, click paths, or app session lengths.
• No User Identification: We do not assign device IDs, advertising identifiers, or account tracking tokens.
• Zero Access to Passwords or Encryption Keys: Because we do not run proprietary servers or account systems, your master passphrases, cryptographic keys, and vault contents never reach us.

The only personal information we process is data you explicitly send to us:

• Email Inquiries & Early Access: When you email us at contact@digitalgraffiti.org or request early access, we receive your email address and any message content you provide. We use this strictly to communicate with you and support your inquiry.
• No Sale or Data Sharing: We never sell, rent, license, or trade your contact information to third parties, advertisers, or data brokers under any circumstances.

Security and privacy are enforced at the code level:

• Memory-Safe Rust Engine: Core vault logic is implemented in Rust, preventing memory vulnerabilities, buffer overflows, and unsafe memory exposure.
• Authenticated Encryption & Key Derivation: Vaults are secured using Argon2id (winner of the Password Hashing Competition) for key derivation and encrypted with XChaCha20-Poly1305 authenticated encryption.
• Double-Layered Encryption: Passwords are encrypted individually within the vault, and the entire vault is encrypted again before touching storage or cloud sync.
• Hardware-Backed Biometrics & Memory Scrubbing: Zero-knowledge biometric unlock utilizes your device's Secure Enclave, while active memory scrubbing (zeroization) purges plaintext credentials from RAM immediately after use.
• Zero-Knowledge Architecture: Because we operate no servers and have zero access to your master passphrase or keys, Digital Graffiti LLC cannot decrypt your vaults or recover lost passphrases.

Our website (digitalgraffiti.org) is static, lightweight, and privacy-respecting:

• We do not set tracking cookies or third-party advertising scripts.
• No cross-site tracking, remarketing pixels, or social network trackers are embedded on our site.

Regardless of your jurisdiction (including GDPR in Europe and CCPA/CPRA in California), you retain full rights over your data:

• Right to Erasure: You can request deletion of any support email history by contacting us directly.
• Right to Access: You may request a copy of any correspondence sent to Digital Graffiti LLC.

If we update this Privacy Policy, changes will be posted on this page with an updated revision date.

For questions or privacy inquiries, contact Digital Graffiti LLC at:

Email: contact@digitalgraffiti.org