Privacy Policy

Last updated: draft.

Our privacy stance

Civility is end-to-end encrypted. The content you store — your documents and files — is encrypted on your device before it reaches our servers. We cannot read it. This isn't a policy promise; it's an architectural property. See our Security page for how it works.

What we can see

To operate the sync service, our servers necessarily process:

Account data — your email address and an Argon2id hash of your password (never the password itself).
Encrypted payloads — the ciphertext of your changes and blobs, which we store and replicate but cannot decrypt.
Structural metadata — system-generated identifiers, collection names, per-collection document counts, blob sizes and content-hash references, and sync timestamps. This is app structure, not your content.
Usage metering — storage, bandwidth, and sync-operation counts, used for quotas and billing.
Operational logs — limited request metadata for reliability and abuse prevention.

What we cannot see

The content of your documents (the encrypted change payloads).
The content of your files (encrypted blobs).
Your user-defined property values.
Your encryption keys — your Master Encryption Key is stored only in wrapped form.

Payments

Paid plans are billed through Stripe. Card details are entered on Stripe's hosted checkout and are never seen or stored by Civility. We store only the opaque customer and subscription identifiers Stripe returns. Stripe's handling of payment data is governed by Stripe's privacy policy.

Data retention

Encrypted data is retained while your account is active. Change history may be pruned on a schedule (the most recent version of each document is always preserved). When you delete your account, your associated data is deleted.

Your choices

You can export or delete your data at any time, and you can run the entire platform yourself — the software is open and self-hostable, in which case no data reaches us at all.

Contact

Questions about this policy? Email privacy@civility.cloud.