Privacy Notice

Effective: September 24, 2026 Entity: Chrysaor, Ltd., a subsidiary of Peleus, Inc.

Here’s what we actually do with your information — not the version written to sound reassuring, the version that’s true.

Chrysaor, Ltd. is a subsidiary of Peleus, Inc. This Notice explains what we collect, why, where it goes, how we protect it, and what choices you have. Read it alongside the Terms of Service, because a lot of what’s true about your privacy here is a direct result of how the product is built, not just what a policy says.

The short version: some of our products are built so that your workspace content is encrypted on your device before it ever leaves it, and only decrypted again on a device you’ve authorized. When that’s true, we’re telling you plainly — because it means there are things we genuinely cannot see, not just things we’ve promised not to look at.

1. What We Actually Believe

Collect less. If we don’t need it to run, secure, or improve the Service, we don’t want it.
Keep content private. Where a product uses client-side or end-to-end encryption, your readable content doesn’t ordinarily reach our servers.
Give you control. Over your data, your storage, your authentication, your account.
Keep operational data separate from your content. Security logs and your actual documents aren’t the same bucket, and we keep them apart wherever we technically can.
We don’t monetize your private content. We’re not selling what’s in your workspace.
We describe what we do, not what sounds good. We won’t tell you “we collect nothing” if that’s not literally true. It usually isn’t, for any real product.

What applies to you specifically depends on which product you’re using and how it’s built. We’re not going to pretend every feature works identically.

2. What We Collect

2.1 Account and Verification Information

To create and secure your account, we handle things like your email address, account identifiers, verification and authentication data, and records of account changes and consents.

Email verification, specifically: we use your email to send a short-lived code, and that’s it. The code expires; we discard it once it’s served its purpose. We don’t quietly add your email to a marketing list. If we ever want to use it for marketing, we’ll ask, or rely on a legal basis that actually permits it.

2.2 Device and Authentication Metadata

We track things like device identifiers, cryptographic key metadata, public keys, session state, and security timestamps — enough to recognize your device and keep your account safe.

Important distinction: this metadata tells us a device is authorized. It does not, by itself, hand us the contents of your encrypted data. Knowing which key opened the lock isn’t the same as seeing what’s inside.

2.3 Your Workspace Content

Email, calendar entries, documents, notes, files, attachments — whatever you put into a Chrysaor workspace.

Where client-side encryption applies: your device generates or holds the key, encrypts the content before it’s sent anywhere, and only an authorized device decrypts it again. Our backend, in that architecture, sees ciphertext — not your actual words. The specifics vary by product, so check the documentation for the one you’re using if it matters to you.

2.4 Operational and Security Information

We keep logs — security events, abuse signals, authentication attempts, diagnostics, rate-limiting triggers, fraud indicators. We’re not going to claim “zero logs,” because that would be false for any service that has to defend itself against abuse. What we will say is that we try to keep that logging minimal, and we try not to collect readable content when the product’s design doesn’t require it.

2.5 Website and Technical Information

Visit our website, and we pick up the standard stuff — IP address, browser, device type, pages requested, timestamps, referrers, errors, and abuse-prevention signals. We’re not using this to build an ad profile of you as a private-workspace user. That’s not the business we’re in on this side of the product.

3. What We Use It For

Running the Service — accounts, authentication, verification codes, sync, support, and keeping features working.

Security — catching unauthorized access, detecting abuse, investigating incidents, enforcing controls, protecting you and everyone else on the Service.

Reliability and development — diagnosing failures, watching performance, building what comes next. Where we can do this without touching your readable content, we do it that way.

Legal compliance — meeting our obligations under the law, responding to valid legal process, protecting our rights and yours.

4. What We Do Not Do

Unless we’ve told you otherwise for a specific product:

We don’t sell your private workspace content.
We don’t use your readable content to build ad profiles.
We don’t hand your workspace content to advertisers.
We don’t dig into encrypted content just to profile you.
We don’t train AI or machine-learning models on your private content without telling you separately and getting whatever consent the law requires.

And where the architecture genuinely locks us out of your readable content — we can’t use what we can’t see. That’s not a policy choice at that point; it’s a technical fact.

5. How Encryption Actually Works Here

Where client-side encryption is in play:

Your device generates or holds the encryption key.
Content gets encrypted before it leaves your device.
What travels or syncs is the encrypted version.
Our backend doesn’t ordinarily get the readable version.
Decryption happens on a device you’ve authorized.

This is deliberate — it shrinks how much of your private information we’re even capable of accessing. But it’s not universal. Not every feature or communication under the Chrysaor name uses the same architecture, so if the details matter to you for a specific product, go read that product’s documentation rather than assuming. See also our Privacy architecture page and the Learn hub for the plain-language version of this.

6. If You Pick Your Own Storage

Some products let you sync encrypted data to storage you choose — your own WebDAV server, a storage provider you selected, wherever. When you do that, we send the encrypted blob to that location so your devices can stay in sync. Where the design supports it, we’re not routing your plaintext content or your long-term storage credentials through our own servers.

That third-party storage provider has its own privacy practices. We don’t control them, and choosing to use them is your call, not ours.

7. Who We Share Information With

We don’t sell your personal information for money.

Service providers who help us run things — email delivery, infrastructure, security, support — get access only to what they need to do that job, under contractual protections.

Legal process — subpoenas, court orders, warrants, regulatory demands — gets a response consistent with the law. Where we can legally tell you first, we try to. But we can’t disclose what we don’t have. If the encryption architecture means we can’t read your content, a legal request doesn’t change the math — we still can’t produce it.

Protecting rights and security — we may share information to protect users, investigate fraud or abuse, or respond to a genuine security incident.

If Chrysaor is acquired, merged, or restructured — information may transfer as part of that deal, and whoever inherits it inherits the privacy obligations attached to it.

8. Who Else Touches Your Data

We use a limited set of third-party providers to run parts of the Service. Which ones, specifically, depends on the product, your region, and our infrastructure setup at the time — we’ll publish a real list of who’s actually in use for a given product, not a list of who we might theoretically use someday.

9. How Long We Keep Things

Verification codes: gone once they’ve done their job.
Account information: kept while your account’s active, and for a reasonable stretch after, if we need it for security, legal, accounting, or fraud reasons.
Security and operational logs: kept as long as reasonably needed for security, investigations, legal defense, or basic recordkeeping — not indefinitely for its own sake.
Your encrypted content: if it’s sitting in storage you or a third party controls, that storage’s own rules govern retention. We may not even have access to it, let alone control over how long it sticks around.

10. Deleting Your Data

Use your account controls, or email privacy@chrysaor.net, and we’ll process the deletion consistent with the law.

Be realistic about what “deleted” means: backups, security logs, and systems we can’t instantly rewrite may hold traces for a while. We may also have to keep certain things — legal obligations, fraud prevention, dispute resolution — even after you’ve asked us to delete the rest.

If your content lives with a third-party storage provider you picked, deleting it from their systems is something you do through them, not us.

11. Getting Your Data Out

Where a product supports it, you can export your workspace content. If that content was client-side encrypted, it gets decrypted locally on your device before it’s written into the export file — meaning the exported file itself is no longer protected the same way the original was inside our Service. Once it’s out, securing it is on you.

12. Your Privacy Rights

Depending on where you live, you may have rights to know what we collect, correct it, delete it, port it elsewhere, object to or restrict certain processing, withdraw consent, opt out of a sale (we don’t do sales, but the right exists on paper), appeal a decision we made about your request, and generally get a straight answer from us about our practices.

Not every right exists everywhere, and exceptions apply. Contact privacy@chrysaor.net to exercise any of this. We may need to verify it’s actually you asking before we act — that’s a protection for you, not a stall tactic. We won’t punish you for exercising a right the law gives you.

13. California Residents

If the CCPA applies to us and to what we’re doing with your information, you have rights to know what we collect and why, where it came from, who we’ve shared it with, and rights to access, correct, delete (with the usual exceptions), opt out of sale or sharing, limit use of sensitive information, and appeal our decisions.

We don’t sell your personal information for money. If that ever changes in a way the law would call a “sale” or “sharing,” we’ll give you the disclosures and opt-outs California law requires — not after the fact, when it’s required.

Reach us at privacy@chrysaor.net, or by the phone number and address at the bottom of this Notice.

14. EU, UK, and Other Comprehensive Privacy Regimes

If you’re covered by GDPR, UK GDPR, or a similar law, you may have rights to access, correct, erase, restrict, port, or object to how we process your information, withdraw consent, and complain to your local supervisory authority.

Where the law requires it, we’ll tell you the legal basis we’re relying on for a given use — contract, legal obligation, legitimate interest, consent, or whatever else applies. Contact privacy@chrysaor.net, and we’ll respond within whatever deadline the law sets.

15. Moving Data Across Borders

We may run infrastructure, or work with providers, outside your home country. When we move personal information across borders, we use the safeguards the law requires — standard contractual clauses, adequacy findings, whatever’s appropriate to the jurisdiction. If cross-border transfer specifics matter to your situation, ask us directly at privacy@chrysaor.net — our infrastructure changes as we grow, and we’d rather give you a current answer than a stale one written into this document.

16. Cookies

We use cookies for the boring, necessary stuff: keeping you logged in, authenticating you, stopping abuse, remembering preferences, understanding basic performance. If we ever add non-essential analytics or advertising cookies, you’ll get the disclosures and choices the law requires. We don’t use your private workspace content for ad targeting, cookies or otherwise.

17. Marketing

We’re not selling your workspace content to advertisers, and we’re not building ad profiles out of it. If we send marketing emails, you can opt out of those specifically. Service notices — security alerts, account notices, legal notices — aren’t optional marketing; you’ll keep getting those because they’re how we keep your account safe and compliant.

18. Children

Chrysaor isn’t built for kids, and we don’t knowingly collect personal information from children under the age where parental consent would be required. If you believe a child’s information ended up with us in a way it shouldn’t have, tell us at privacy@chrysaor.net, and we’ll take appropriate steps to delete it.

19. Security

We use encryption, authentication controls, device authorization, access controls, monitoring, abuse prevention, data minimization, and incident response to protect your information. What that looks like in practice depends on the specific product and how it’s built.

No security system is bulletproof, and we won’t tell you ours is. We also won’t claim a certification or security standard we haven’t actually earned — that kind of claim only means something if it’s true.

20. If Something Goes Wrong

If we have a security incident involving your personal information, we investigate and respond as the law requires — including notifying you, regulators, or others where notification is legally required. What that notice looks like, and how fast it comes, depends on what actually happened.

21. Government and Legal Access

We evaluate legal requests against the law, and where we’re legally allowed to, we try to notify you before disclosing anything. We can’t hand over information we don’t have — and if a product’s architecture means we can’t read your encrypted content, receiving a legal request doesn’t magically give us access we were never designed to have. We can still disclose other information we do legitimately hold, where the law requires or permits it.

22. Changes to This Notice

We’ll update this Notice as our products, the law, or our practices change, and we’ll update the date at the top when we do. If a change is material, we’ll give you more notice than just a date change, where the law requires it. We’re not going to walk back a real privacy commitment in a way the law wouldn’t allow. Keep using the Service after an update takes effect, and that counts as acknowledgment, to the extent the law lets it.

23. Product-Specific Privacy Details

Some products have their own privacy documentation covering their specific data flows, encryption design, storage setup, or subprocessors. If that product-specific document says something different from this general Notice, the specific one wins for that product — but only where it actually says so.

24. Contact Us

Chrysaor, Ltd.
A wholly owned subsidiary of Peleus, Inc.
1001 S. Main St. #13163, Kalispell, MT 59901, United States

Privacy: privacy@chrysaor.net
Legal: legal@chrysaor.net
Phone: (406) 476-9775

For anything about your privacy rights specifically, privacy@chrysaor.net is the fastest way to reach us.