Privacy Policy

When you sign up we collect your email address and a securely hashed version of your password. If you sign in with Google or Apple, we receive your email address and a unique sign-in identifier (and, from Google, optionally your name).

To run and secure the Service we process basic technical data such as device type and operating system, your IP address (used for authentication and security), and crash/diagnostic logs. These logs never contain the contents of your documents.

You upload documents into encrypted folders. Your files, your file names, and your folder names are all encrypted on your device before they reach us — so we store them only in unreadable form.

When our AI scanner reads a document, it produces a small set of details — such as document type (e.g. "Passport"), expiry date, and suggested tags. These details are encrypted on your device with your own key before they are stored, so they are held by us only in unreadable form.

Everything is encrypted on your device before it leaves your hands. Your key stays with you — we never receive it, so we cannot read your vault.

Because only you hold your keys, neither RacDoc nor our service providers can read your stored documents, file names, folder names, or document details. Our systems hold only encrypted data and the access-control records needed to run your account.

Our backend is not given your plaintext files, plaintext file keys, plaintext file names, or plaintext folder names. When you use AI scanning (Section 5), your document is read to extract its details, and the results are encrypted on your device before they are stored.

When a document is scanned, your app sends it over an encrypted connection to our secure scanning function, which passes it to our AI processing provider for classification and extraction. The provider returns the detected details (type, expiry date, suggested tags). Your app then encrypts those details with your key before they are stored.

Your document is processed inside a secure hardware enclave — read by the AI to extract its details, never readable by us. The enclave is an isolated environment where the content cannot be viewed by any person.

Your document is processed inside the enclave and is not retained or logged by the AI provider once processing completes.

This AI processing currently takes place in a secure enclave located in the United States. The provider cannot read or keep your document, but this does mean your document is briefly transferred to a US-based enclave at the moment of scanning. We are working to move this processing to Canada as the Service grows.

The AI provider cannot see what your document contains, but it does receive limited technical information needed to route the request — such as connection timing and request size.

We do not send your documents to any other outside AI service (such as general cloud document-AI tools). AI scanning happens only through the secure enclave described here.

The scan only pre-fills a form for you. You can change any detail, and nothing is stored until you confirm. Scanning is optional — if it is unavailable or you skip it, you can always enter a document's details yourself.

When you share a file with another RacDoc user, sharing is done using end-to-end key exchange (X25519 with HKDF-SHA256), so the file is re-encrypted for that recipient. Only encrypted file keys and encrypted content are exposed in the process.

When you create a share link, the shared content is encrypted, and a recipient can open it only with the unique link — and the optional password, if you set one — during the window you choose (1, 7, or 30 days).

When a share expires or you revoke it, the link can no longer be used to open the content. Any copy a recipient already downloaded to their own device is outside our control and remains their responsibility.

A share link, by its nature, can be opened by anyone who has the link — and the password, if you set one — while it is active. Share links only with people you trust. If someone reports a share link to us for abuse and provides the link (and password, if set), we may be able to view what that specific link points to, in order to act on the report.

Your encrypted account data and documents are stored on infrastructure located in Canada. Because everything is encrypted under your key, it remains unreadable wherever it is stored.

As explained in Section 5, the AI scanning step currently takes place in a secure enclave in the United States. This is a brief, transient transfer of your document for processing only — the provider cannot read or keep it. We are working to move this to Canada.

If you are located outside Canada — including in the EU/EEA, the UK, or the US — your encrypted information is transferred to and stored in Canada, which benefits from a European Commission adequacy decision for data transfers.

When you delete a document it is held in Trash for 30 days, during which you can restore it. After 30 days it is permanently deleted.

When you delete your account, your profile, keys, document details, and encrypted documents are removed from our production systems, subject to the same 30-day recovery window before permanent deletion.

We keep encrypted backups for disaster recovery for up to 7 days, after which they are purged. Backups are encrypted and are not used to restore individual deleted accounts.

Accounts inactive for 24 consecutive months may be flagged for deletion after advance email warnings.

If you choose a recovery phrase, it is generated on your device (BIP-39), and key recovery is protected using Argon2id. Your recovery phrase is known only to you — we never see or store it.

If you choose cloud backup recovery, the backup is encrypted on your device with your backup password before it leaves your device, so we cannot read it.

Face ID and fingerprint unlock are handled entirely by your device's operating system. Your biometric data never reaches our servers — the app only receives a yes/no from your device.