IP Vault privacy notice
Almog Shachar, trading as rev3rse runs IP Vault. This notice covers the developers who use the console and API, and, for the part of the service that runs on behalf of developers, the installations of their apps.
Developers
What we hold. Your sign-in identifier from Firebase Authentication, your email address and whether it is verified, how you signed in (GitHub, Google or email), the version and time of the terms you accepted, and the workspaces you belong to.
Why. To sign you in, to decide what you may access, and to record that you accepted the terms. The legal basis is the contract with your organisation, and our legitimate interest in operating the service securely.
Who processes it. Google: Firebase Authentication signs you in, and Cloud Run, Firestore, Cloud KMS and Firebase Hosting run the service. The service's own records are stored in the European Union (Belgium). Firebase Authentication runs only from data centres in the United States: your email address, and the IP address and browser details it logs for a few weeks to prevent abuse, are processed there. If you sign in with GitHub or Google, that provider tells us who you are.
Your workspace
What you register: app package names and signing-certificate fingerprints, entitlements, activation codes (we keep only a one-way digest), CI credentials (we keep only a digest of a token, or the numeric repository identifiers and refs of a binding), and your releases: asset identifiers and versions, digests and sizes of your plaintext and sealed files, key identifiers, the asset keys wrapped under our key-encryption key, and, for CI jobs, the repository, ref, run and commit that published them. We never receive an asset in the clear. Every change is recorded in your workspace's audit log, which you can export.
Installations of your apps
When an installation of your app activates or renews, we process, on your behalf: the public keys its device generated and their digests, what the device's hardware attestation says about them (security level, boot state, the app's signing certificate), the licensee or subject your activation code or voucher names, and the times of activation and renewal. Opening an asset happens on the device, offline; we do not see it. We use them only to issue and renew that installation's licence and to keep your audit log. Where your end users are concerned you are the controller and we process for you.
Retention and your rights
We keep account data while you have an account, and workspace data while the workspace exists and for 30 days after it is closed, except what the law requires us to keep. You may ask for access to, correction of, export or deletion of your data, and object to its processing, at almogs@rev3rse.dev. You may also complain to your data protection authority.
Changes
We will tell you of material changes in the console before they take effect.