Legal

Privacy Policy

How doconvoy handles personal data — the roles we play, what we collect, how encryption keeps your content unreadable to us, your rights, and the limits we're honest about.

Last updated: September 2026

Who we are, and the two roles we play

doconvoy is operated by Larcade Labs Ltd ("Larcade Labs", "we", "us"). We play two different roles depending on whose data it is:

  • For your own account — your email, name, sign-in sessions and billing contact — we are the data controller.
  • For the personal data you collect from other people through doconvoy (what viewers, submitters, and recipients share with you), you are the controller and we are your processor — we handle that data on your instructions, not for our own purposes.

This policy covers the account data we control. How we process data on your behalf is set out in our Data Processing Agreement.

What we collect

  • Account data — your name and email address, your sign-in sessions, and your billing contact.
  • Content you share or collect — encrypted in your browser before it reaches us. We store only the scrambled result and cannot read it.
  • Access metadata — timestamps and view counts, used for your audit trail. Inside the app, device details, location, and IP address are off by default and recorded only if you turn them on.
  • Security logging — like most web services, the infrastructure that protects doconvoy (our content-delivery network and web-application firewall) records technical data such as IP addresses in its protective logs. We rely on our legitimate interest in keeping the service secure and available (Art. 6(1)(f) GDPR), keep these logs only as long as we need them for security, and don't use them to build profiles about you.
  • Billing — handled by our payment provider, Stripe. We see your billing email and your card's brand and last four digits; full card details stay with Stripe.

We never collect the plaintext of your secrets or submissions, and we don't use advertising or cross-site tracking (see our Cookie Policy).

How we use your data

We use account data to provide and secure the service, to produce the audit trail for your workspace, to send you transactional emails (such as sign-in codes and access notices), and to handle billing. We do this to deliver the service you've asked for, to keep it secure, and to meet our legal obligations. We don't sell your data or share it for advertising.

How encryption protects you

Content is encrypted in your browser with strong authenticated encryption (XChaCha20-Poly1305) before it reaches us. The keys stay on your side — for a shared link, the key travels in the part of the link that browsers never send to our servers. Because we only ever hold the scrambled result, there's nothing readable for us to lose, leak, or be compelled to hand over.

Your rights

If data protection law applies to you, you can ask to access a copy of your data, correct it, export it (portability), or have it erased. Erasing someone works by destroying the key that protects their data — so it becomes unrecoverable straight away. To exercise any of these, email privacy@doconvoy.com.

Keeping and deleting data

  • Shared content is kept until it expires or you delete it. Every share has a required expiry (default 3 months, maximum 1 year) — there's no "never expires".
  • Your account — you can delete it yourself. It's a two-step process: you confirm by email, then there's a short recovery window of 15 days in which it can still be recovered, after which it's permanent. Deletion destroys your personal data by crypto-shredding (destroying the keys). You'll need to transfer or delete any workspace you own first.
  • A whole workspace — an owner can delete it. After a short recovery window (about two weeks) we crypto-erase every key for that workspace, so its data becomes permanently unrecoverable.

The limits we're honest about

We'd rather be clear than over-promise:

  • After you delete your account, we keep one minimal record — your previous email address — for up to 3 years to prevent fraud and abuse, then delete it automatically.
  • "Forget this data subject" covers people who viewed or submitted. It doesn't reach the recipients of a delivery one by one, but recipient email addresses are removed when you delete the whole workspace, as part of the purge.
  • A few email addresses (such as a pending invitation, or your billing contact) are stored in readable form because the service needs them to work.
  • Turning off optional access metadata (device, location, IP) stops new collection; it doesn't rewrite records already made.
  • Emails we've already sent — like sign-in codes and notices — can't be recalled.
  • Data held by our providers (for example, your Stripe billing record) follows their own deletion timelines.

Who else handles data (sub-processors)

We host application data with AWS in the EU and rely on:

  • AWS — storage, transactional email delivery, and content delivery.
  • Stripe — payments.

Our public marketing site uses privacy-friendly, cookieless analytics. The full list, with what each provider handles and where, is on our Sub-processors page. We'll tell customers before adding a new sub-processor that handles data we process for them.

California residents (CCPA)

We do not sell or share personal information, and we offer no financial incentives in exchange for it. Because the selling and sharing never happen, there is nothing to opt out of. California residents have the same access, correction, and deletion rights described above; to exercise them, contact privacy@doconvoy.com.

Changes and contact

We'll update this page as the service evolves. For any privacy question, or to exercise your rights, contact privacy@doconvoy.com.