Privacy Policy

Who we are

doconvoy is operated by Larcade Labs Ltd (“Larcade Labs”, “we”, “us”, or “our”). Larcade Labs is the data controller responsible for the personal data processed through the service, and this policy explains how we handle it.

What we collect

We collect account information (email, name), workspace configuration, encrypted secret payloads and intake submissions, access event metadata (timestamps, view counts, IP addresses when applicable), and billing information processed through our payment provider.

We do not collect or store the plaintext content of secrets or intake submissions. All content is encrypted client-side before reaching our servers.

How we use your data

We use collected data to provide the doconvoy service, generate audit trails for workspace activity, send notifications about secret access and intake submissions, process billing, and respond to support requests.

Encrypted data handling

Secrets and intake submissions are encrypted with strong, industry-standard authenticated encryption (XChaCha20-Poly1305) in the user's browser before transmission. Encryption keys are held client-side — for shared links, the key travels in the URL fragment, which browsers never send to our servers. We store ciphertext only — we cannot decrypt or access the content of your secrets.

Metadata and audit logs

We store metadata about access events — when a secret was accessed, by whom (if email verification was used), and how many times. This metadata is used to generate the workspace audit trail. Metadata does not include secret content.

Data retention

Secrets and intake submissions are stored until they expire (based on your settings) or are manually deleted. Account data is retained for the duration of your account. You can request deletion of your account and associated data at any time.

GDPR rights

If you are subject to GDPR, you have the right to access, correct, or delete your personal data. You may also request data portability or restriction of processing. Contact us at privacy@doconvoy.com to exercise these rights.

Third-party services

We use third-party services for infrastructure hosting, payment processing, and transactional email. These services are chosen for their security and compliance posture. We do not sell or share your data with third parties for advertising purposes.

Contact

doconvoy is a service of Larcade Labs Ltd. Privacy inquiries: privacy@doconvoy.com