Privacy Policy

Last updated: October 13, 2026

1. Information We Collect

Sprott collects minimal information necessary to provide our service: your email address for authentication, and encrypted vault data. We do not collect, store, or have access to your plaintext credentials, API keys, or biometric data. All sensitive data is encrypted on your device before transmission using AES-GCM-256.

2. How We Use Your Information

Your email is used solely for account authentication and service notifications. Encrypted vault data is stored only to provide the Sprott service, and is never used for advertising or analytics. To understand how people find and use Sprott, we collect privacy-respecting usage analytics such as page views and feature-usage events; these never include your credentials, vault contents, or other sensitive data. We do not sell or rent your personal information.

3. Data Security

Sprott employs end-to-end encryption (AES-GCM-256). Encryption keys are derived and held on your devices and unlocked with your passkey (WebAuthn); we never receive your biometric data. Our servers store only ciphertext. We cannot decrypt your data.

4. Google User Data

Sign-in. When you sign in with Google, we receive only your email address and basic profile information, used solely to create and authenticate your account.

Connected Google services. When you connect a Google service (such as Gmail) to a vault, the OAuth tokens Google issues are encrypted on your device and stored only as ciphertext; our servers cannot decrypt your vault. When one of your agents calls that service, our broker attaches the token to the request in transit and relays the response to your agent. The content of your Google data (such as messages or files) is processed transiently in memory for that relay and is never stored on our servers, never read by a human, and never used for advertising, analytics, or training machine-learning models.

Sprott's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access. Disconnect a Google service from your vault at any time, which deletes its stored tokens, or revoke Sprott's access at myaccount.google.com/permissions.

5. Third-Party Services

When you purchase a paid plan, payment is processed by Creem, our merchant of record; we never receive your card details. Our infrastructure providers host only ciphertext and the minimal account records described above. Sprott does not sell or share your vault data with any third party.

6. Data Retention & Deletion

Deleting a connection deletes its stored tokens. Deleting a vault deletes its encrypted contents everywhere. You can delete your account and all associated encrypted data at any time; activity logs age out automatically.

7. Contact

For privacy-related questions, contact us at team@safeclaw.pro.