Can Ciphera read my email address?

Your email address is stored in a client-encrypted vault that Ciphera operators cannot decrypt. When we send you a transactional email, our notification service briefly decrypts your address in process memory to compose the SMTP message. The plaintext exists for milliseconds, is never logged, and is garbage-collected after the send completes. At rest, your email is AES-256-GCM encrypted.

What happens to my data if I delete my Ciphera account?

Your encrypted vault (containing email and profile data) is permanently deleted — the bytes are overwritten with random data before the DELETE to defeat WAL/backup recovery. Your SRP verifier and blind index are removed. All refresh tokens are revoked. Notification metadata (template name, delivery status — not your email address or message body) in the email log is purged, and on the analytics backend every notification receipt belonging to you is hard-deleted via a pre-cascade scrub that the auth service invokes before your user row drops — with in-DB foreign-key cascades handling the rest. Device-tracking hashes and audit log entries are bounded by their retention periods.

Does Ciphera use Google Analytics or set cookies?

No. The Ciphera website uses only Pulse, our own privacy-first analytics platform. Pulse sets zero cookies, stores no raw IP addresses, and generates daily-rotating session identifiers. No Google Analytics, Meta Pixel, Hotjar, or third-party tracking scripts are loaded on any Ciphera property.

What could Ciphera produce if served with a legal data request?

Account UUID, creation and login timestamps, subscription status, encrypted vault (which we cannot decrypt without the user's password), SRP verifier (cryptographically useless without the original password), raw IP addresses from device-tracking tables, hashed IPs from audit logs, notification metadata (typed event payloads with allow-listed fields only — no email addresses, IP addresses, or message bodies — plus per-user read/dismiss state and per-channel delivery log), and database backups up to 12 months old containing the same encrypted data.

Does Pulse track individual visitors across visits?

No. Pulse generates a new session identifier each day using a one-way hash of IP address, user-agent, domain, and date. The same visitor on consecutive days receives different session IDs with no link between them. There are no cookies, no localStorage tokens, and no persistent visitor identifier. Raw IP addresses are discarded immediately after the hash computation.

Back to Blog

PrivacyBy Ciphera Team10 min read12-04-2026

What We See About You, What We Don't, and Why It Matters

Privacy7 min read

Your AI Assistant Is Training on Your Data — Here's What ChatGPT, Gemini, and Meta AI Actually Collect

Privacy7 min read

Data Brokers Have 10,000 Data Points on You — Here's How to Delete Them

Privacy7 min read

The EU-US Data Privacy Framework Is Built on an Executive Order — and That's the Problem

Back to all posts

What We See About You, What We Don't, and Why It Matters

Related Articles

Your AI Assistant Is Training on Your Data — Here's What ChatGPT, Gemini, and Meta AI Actually Collect

Data Brokers Have 10,000 Data Points on You — Here's How to Delete Them

The EU-US Data Privacy Framework Is Built on an Executive Order — and That's the Problem