How Altrix Labs handles your personal data when you use AveryQ, and the rights you have — written to align with India's Digital Personal Data Protection Act, 2023 (DPDP Act).
AveryQ is operated by Altrix Labs Private Limited ("Altrix Labs", "we", "us"), the Data Fiduciary for the purposes of the DPDP Act. You can reach us at contact@altrixlabs.ai.
Because of our zero-knowledge design, we deliberately process as little as possible. The table shows what is involved and, crucially, whether we can read it.
| Data | Why | Can we read it? |
|---|---|---|
| Google account identity (name, email, Google user ID) | To sign you in and identify your vault, via Google Sign-In. | Yes — basic identity only |
| Your vault content (documents, records, attachments) | The purpose of the product — stored in Firestore. | No — encrypted ciphertext only |
| Signed-consent record & audit log | Proof you accepted the terms; a tamper-evident (SHA-256) activity trail. | Metadata only |
| Family-share metadata | To operate share links you create; the decryption key lives only in the link, never on our servers. | No key stored |
| Technical data (IP address, device/browser) | Processed by Google/Firebase infrastructure to deliver and secure the service. | Via Google infrastructure |
We do not run analytics, advertising, profiling or tracking, and we do not sell or rent your data to anyone. See our Cookies Policy for storage technologies.
We process the above solely to: (a) create and secure your account; (b) store and sync your encrypted vault; (c) operate features you use, such as family sharing and AI auto-fill; and (d) meet legal and security obligations. Under the DPDP Act, our basis is your consent — captured through the signed in-app consent — together with what the Act recognises as certain legitimate uses (e.g. security). You may withdraw consent at any time (see Section 6).
We use a small set of trusted service providers, each governed by its own terms:
We share personal data with authorities only where required by law.
We keep your account and encrypted vault for as long as your account is active. When you delete your vault or account, the associated data is removed. Because we hold only ciphertext, deletion permanently removes any ability to recover the content.
Under the DPDP Act you have the right to:
To exercise any right, email contact@altrixlabs.ai.
Your vault is protected with AES-256-GCM authenticated encryption, using a key derived from your master password via PBKDF2 (250,000 iterations). Keys are non-extractable and never leave your device. Sign-in uses Google or email authentication, and your master password derives the encryption key on your device. Your master password cannot be recovered — if you lose it, your vault cannot be decrypted, by design.
AveryQ is intended for adults. We do not knowingly create accounts for children under 18 without verifiable parental consent as required by the DPDP Act. If you believe a child has provided data to us, contact us and we will remove it.
Your encrypted data is stored on Google Cloud / Firebase infrastructure in Mumbai, India. Because your vault content is encrypted on your device before upload, we only ever hold ciphertext — no provider, in any country, can read it. Google's contractual safeguards apply to the underlying infrastructure.
As a user in the United States: your data is stored in India, not the US. We disclose this plainly rather than claim US-local storage — the on-device encryption is the safeguard for that transfer, so only you can read your vault.
As a user in the United Kingdom: your data is stored in India, not the UK. Under UK GDPR this is an international transfer; because only you hold the decryption key, the on-device encryption is the safeguard, alongside Google's contractual protections for the infrastructure.
We may update this policy as the product or law evolves. Material changes will be reflected in the date above and, where required, we will seek your consent again.
For any privacy question or to reach our grievance contact, email contact@altrixlabs.ai.