Privacy Policy
This policy explains what data Credals collects, how it is encrypted and stored, who we share it with, and the rights you have over it.
Last updated: July 4, 2026
1. Who we are
Credals ("Credals", "we", "us") provides an encrypted credential vault that helps freelancers organize logins, API keys and tokens by client, project and platform. You can reach us at hello@credals.com for any privacy-related request.
2. Data we collect
- Account data: your email address, used for authentication and account recovery through Supabase Auth.
- Credential data: the logins, API keys and tokens you store. These values are encrypted with AES-256-GCM before they reach our database. We store ciphertext, never the plaintext of your secrets.
- Usage data: basic technical and usage information (such as log data and aggregate analytics) needed to operate, secure and improve the service.
3. How encryption works
Every credential value is encrypted using AES-256-GCM before it is written to the database. GCM is an authenticated encryption mode, so each stored value carries an integrity tag that detects tampering. The database only ever contains encrypted ciphertext. Your account password is handled by Supabase Auth and is decoupled from the server-side encryption key.
4. Third parties we use
- Supabase: PostgreSQL database and authentication.
- Vercel: application hosting and content delivery.
These providers process data on our behalf under their own security and privacy commitments. We keep the third-party surface deliberately small.
5. How we use your data
We use your data solely to provide and secure the service: to authenticate you, store and retrieve your encrypted credentials, prevent abuse, and improve reliability. We do not sell your data.
6. Data retention
We retain your data for as long as your account is active. When you delete your account, your stored data is removed from our systems.
7. Your rights
- Access & export: you can request a copy of your data. A self-serve export of your encrypted credentials is on the roadmap.
- Deletion: you can delete your account at any time, which removes your stored data.
- Correction: you can update your account information from within the app.
To exercise any of these rights, email hello@credals.com.
8. Changes to this policy
We may update this policy as the service evolves. Material changes will be reflected by updating the date at the top of this page.
9. Contact
Questions about this policy or your data? Email hello@credals.com.