1. Privacy Policy

1.1 Introduction

Stegure (“we,” “our,” or “us”) is committed to protecting your privacy and ensuring the security of your data. This Privacy Policy explains how we collect, use, and safeguard your information when you use the Stegure website and application. Our core philosophy is Zero-Knowledge, meaning we design our systems so that we cannot access your private encrypted data.

1.2 Data We Collect

A. Information You Provide

• Account Information: When you register, we collect your username, email address, and phone number (if applicable). This is strictly for account management, password recovery (via Master Key), and communication.
• Payment Information: If you purchase a subscription, our third-party payment processors (e.g., Razorpay, Stripe) collect your payment details. Stegure does not store your credit card or bank account numbers.

B. Automatically Collected Information

• Device Information: We may collect non-personal information about the device you use to access Stegure, including the hardware model, operating system version, and unique device identifiers.
• Log Data: Our servers may record standard log data such as your IP address, browser type, and timestamps. This is used solely for debugging, security monitoring, and improving service stability.

1.3 Data We DO NOT Collect (Zero-Knowledge)

• Your Master Password (MPIN): Your MPIN is hashed locally on your device. We never receive or store the plain-text version. If you lose your MPIN and your Master Recovery Key, we cannot recover your account.
• Your Decrypted Content: All encryption and decryption processes occur locally on your device (Client-Side Encryption). We never possess the private keys required to decrypt your images or files.
• Your Source Files: We do not upload your unencrypted original images or files to our servers.

1.4 How We Use Your Data

We use the limited data we collect to:

• Provide, operate, and maintain the Stegure service.
• Process your transactions and manage your subscription.
• Send you administrative emails, such as security alerts or support updates.
• Detect and prevent fraudulent or abusive use of our services.

1.5 Data Retention

• Account Data: Retained as long as your account is active. You may request deletion at any time.
• Encrypted Data: If you use our cloud storage features (if applicable), encrypted files are stored until you delete them.

1.6 Third-Party Services

We may verify your data with third-party services for specific purposes:

• Payment Gateways: To process secure payments.
• Analytics: To understand anonymized user behavior (e.g., Google Analytics), without tracking individual encrypted content.