Effective Date: October 2026•Version: 2.4 (Enterprise & Public)•Status: Active & Enforced
This Privacy Policy governs your use of tockenvault.com (the “Site”), the TokenVault web dashboard, and the client-side token-vault.js middleware SDK (collectively, the “Service”), operated by TokenVault (“we”, “us”, or “our”). We are committed to absolute transparency and rigorous data protection.
Zero-Knowledge Architecture
Your prompt texts, model completions, and private LLM API secret keys are never stored, logged, or transferred to external persistent databases.
Client-Side Memory Shield
Deduplication and cache lookup run in a 512 KB local memory buffer inside your application runtime. Cached payloads stay strictly local.
Lemon Squeezy PCI-DSS Level 1
Subscription billing is managed entirely by Lemon Squeezy (Merchant of Record). TokenVault never sees or retains credit card or bank details.
Google Limited Use Compliance
Authentication follows strict Google API Services User Data Policy guidelines. Account email is solely utilized for identity verification and digests.
1. Zero-Knowledge Architecture & Prompt Privacy
TokenVault is architected from the ground up on zero-knowledge security principles. Unlike conventional analytics platforms that ingest, index, and analyze raw conversational data:
No Raw Prompt Storage: We do not capture, log, serialize, or persist your users' raw prompt texts, conversation histories, or model outputs.
No API Secret Key Exfiltration: Your private provider keys (such as OpenAI, Anthropic, or Google Gemini API keys) remain exclusively within your local server environment or local browser session. The TokenVault SDK wraps standard network calls locally and never transmits your API keys to our servers.
Local Cache Containment: The 512 KB in-memory ring buffer used for query deduplication executes entirely within your app's runtime process memory. Cache hits are resolved in sub-millisecond local RAM without external network traversal.
Zero Data Brokerage: We never sell, rent, trade, or commercialize your telemetry, prompts, or personal information under any circumstances.
2. Information We Collect
We adhere to strict data minimization. The only data processed by TokenVault includes:
A. Account & Identity Data (via Google OAuth)
When you sign in using Google Authentication, we collect your verified email address, display name, and avatar URL provided by Google. This data is strictly used to create your workspace session, bind your subscription status, and optionally deliver scheduled daily/weekly cost optimization digests you request.
B. Aggregate Telemetry & Optimization Metrics
To compute savings rates, detect runaway infinite loops, and display workspace efficiency analytics, our client SDK generates non-reversible aggregate telemetry. This telemetry includes numeric token counts (input and completion counts), request latency in milliseconds, HTTP response status codes (e.g., 200, 429, 500), model name identifiers (e.g., “gpt-4o”, “claude-3-5-sonnet”), and SHA-256 one-way cryptographic hash digests of prompt fingerprints to identify duplicate query frequency without revealing prompt content.
C. Technical & Operational Logs
Standard web server diagnostic logs such as anonymized IP address, browser user-agent, and referring URL are retained on a temporary 14-day rolling buffer strictly for DDoS prevention, operational health monitoring, and security telemetry.
3. Third-Party Payment Processing (Lemon Squeezy)
All customer financial transactions, recurring monthly subscriptions, and currency processing for TokenVault plans (Pro and Enterprise) are exclusively managed by our authorized Merchant of Record, Lemon Squeezy, LLC.
No Payment Card Retention: TokenVault never receives, transmits, stores, or processes complete credit card numbers, debit card CVVs, or banking account details.
PCI-DSS Level 1 Compliance: All payment input fields are securely served by Lemon Squeezy using bank-grade encryption certified under PCI-DSS Level 1 standards.
Subscription Webhook Tokens: Lemon Squeezy provides TokenVault with a cryptographically signed webhook containing your Lemon Squeezy Customer ID, order reference, plan tier, and subscription active/cancelled status so your workspace privileges can be provisioned.
4. Google OAuth & Data Usage (Limited Use Requirements)
TokenVault complies fully with the Google API Services User Data Policy, including the rigorous Limited Use requirements:
TokenVault's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
We do not use Google user data for serving personalized, retargeted, or interest-based advertisements.
We do not permit humans to read Google user data unless required for technical support requested explicitly by the user, required for law enforcement compliance, or when aggregated and fully anonymized for internal security auditing.
We do not transfer or disclose Google user data to third parties, except as strictly necessary to provide or improve the core user-facing functionality of TokenVault with user consent.
5. Data Retention & User Deletion Rights
You maintain sovereign ownership of your data at all times. Because raw prompts and secret API keys are never held on TokenVault servers, our data footprint is minimal:
Account Deletion: You may request complete, irreversible deletion of your account, workspace configuration, and associated telemetry records at any time by emailing us at omnidesk03@gmail.com. Deletion requests are fulfilled within 5 business days.
Local Browser Cache Reset: Local memory caches and browser storage tokens can be purged instantly by clearing browser cache or calling the SDK's reset method.
Telemetry Retention: Aggregated numeric metrics are maintained for 12 months for historical billing projections, after which they are permanently purged.
6. Security Safeguards
We implement industry-standard administrative, physical, and technical controls to guard system integrity:
Transport Layer Security (TLS 1.3) encryption enforced for all web and API traffic.
Edge hosting on Cloudflare infrastructure with automated DDoS mitigation and firewall rules.
One-way SHA-256 cryptographic hashing for all telemetry signatures.
If you have any questions, compliance inquiries, or requests regarding this Privacy Policy or our zero-knowledge implementation, please contact our team directly: