Privacy Policy

Who We Are

Sanctum is operated by Monzie, an Australian business. If you have any questions about this Privacy Policy, please contact us at [email protected].

What We Do NOT Collect

We do not collect:

• Your files, photos, videos, or documents
• The contents of anything you upload or download
• Your browsing history or activity within your vault
• Any data transmitted through your Cloudflare tunnel

What We Do Collect

We collect only the minimum information needed to provide the service:

• Account information — your email address and hashed password when you create an account
• Subdomain — the personal URL you choose (e.g. yourname.sanctumfiles.com)
• Payment information — processed securely by Stripe. We never see or store your full card details
• Device information — device name and platform (e.g. Windows) for device limit enforcement
• Subscription status — your plan type and billing status

How We Use Your Information

We use the information we collect only to:

• Create and manage your Sanctum account
• Process your subscription payments via Stripe
• Provision and manage your Cloudflare tunnel
• Send transactional emails such as password resets and payment receipts
• Enforce device limits based on your subscription plan
• Respond to your support requests

We do not use your information for advertising, marketing to third parties, or any purpose beyond operating the Sanctum service.

Third-Party Services

Sanctum uses the following trusted third-party services to operate:

• Stripe — payment processing. Subject to Stripe's Privacy Policy
• Cloudflare — tunnel and DNS services. Subject to Cloudflare's Privacy Policy
• Resend — transactional email delivery. Subject to Resend's Privacy Policy
• Vultr — backend server hosting in Sydney, Australia

We do not sell, rent, or share your personal information with any other third parties.

Data Storage & Security

Your account data is stored on our backend server hosted in Sydney, Australia. We implement industry-standard security measures including:

• Encrypted passwords using bcrypt hashing
• HTTPS encryption on all connections
• JWT authentication for all API requests
• Cloudflare protection on all public endpoints

Data Retention

We retain your account information for as long as your account is active. If you cancel your subscription and request account deletion, we will delete your account data within 30 days.

Payment records may be retained longer as required by Australian tax law.

Your Rights

Under Australian Privacy Law, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Withdraw consent at any time by cancelling your subscription

To exercise any of these rights, contact us at [email protected].

Cookies

Sanctum does not use tracking cookies or advertising cookies. We use only essential session-based authentication tokens (JWT) stored in your browser's local storage to keep you logged in to your dashboard.

Children's Privacy

Sanctum is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email. Continued use of Sanctum after changes take effect constitutes acceptance of the updated policy.

Governing Law

This Privacy Policy is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. For any privacy concerns, you may also contact the Office of the Australian Information Commissioner at oaic.gov.au.