Privacy Policy
The short version: Aurocrypt (formerly API Vault) is designed to give AI clients specific abilities without giving those clients your underlying credentials. Features that require remote execution use network services, but passwords, provider tokens, API keys, browser cookies, passkeys, and MFA material are not intended to be returned to an AI client.
Account information
If you create an Aurocrypt account, the authentication service processes identifiers needed to sign you in, such as your email address, account identifier, and identity-provider information. Aurocrypt uses that verified identity to keep connected services, AI identities, permissions, billing entitlements, and sync records separated by owner.
Connected provider accounts
When you connect a provider through OAuth, the provider may return authorization tokens, scopes, and account identity information. Aurocrypt stores the authorization needed to perform approved actions server-side. Connecting an account does not automatically grant it to every AI; AI access is assigned separately.
Protected website sign-in
When a configured provider integration is unavailable or incomplete, Aurocrypt can use a protected browser session. Passwords, passkeys, MFA challenges, CAPTCHA interactions, and signed-in browser state remain inside that protected browser boundary and are not intentionally exposed to the AI client.
Vault credentials and sync
Android can keep vault credentials Local only. If you enable encrypted cross-device sync, vault payloads are encrypted before remote storage. If you explicitly enable a vault credential for AI use, Aurocrypt creates protected server-side material needed to broker requests to the approved provider or host; the raw secret is not returned through the AI connector surface.
Connected AI clients
When you connect an AI client such as ChatGPT or Claude, that platform receives the Aurocrypt authorization needed to call only the Aurocrypt tools you approved and receives the results of operations you ask it to perform. Aurocrypt is designed so the AI platform does not receive underlying provider passwords, provider OAuth refresh tokens, raw vault credentials, passkeys, MFA material, or protected browser-session state. Information returned as an approved tool result is then handled by the connected AI platform under that platform's own terms and privacy policy.
You can revoke an AI identity without deleting the provider accounts or signed-in websites you connected to Aurocrypt.
AI permissions and audit records
Aurocrypt stores the permissions you give each AI identity and may retain metadata such as which AI acted, which service or capability was requested, timestamps, outcomes, and approval decisions. Audit records are designed not to contain raw authorization headers, provider passwords, OAuth refresh credentials, or browser cookies.
Billing
Web purchases are handled by Stripe and Android purchases by Google Play. Payment providers may process transaction and payment information under their own privacy policies. Aurocrypt stores entitlement and billing identifiers needed to recognize your plan and manage access.
Infrastructure providers
Aurocrypt currently relies on services that can include Firebase/Google for authentication and Android distribution, Supabase for server-side application services, Cloudflare for the canonical web front door and managed browser infrastructure, and Stripe for web billing.
What we do not do
- We do not sell API credentials, OAuth tokens, browser sessions, or personal data to advertisers.
- We do not intentionally return raw stored credentials to an AI merely because that AI has permission to use an ability.
- We do not automatically grant newly connected accounts or browser sessions to every AI.
- We do not use stored secrets for behavioral advertising.
Security
Encryption, isolation, revocation, and approval controls materially reduce risk, but no application or network service can promise absolute security. Review delegated authority carefully and revoke affected credentials or sessions if you suspect exposure.
Deletion and retention
You can remove individual connected accounts, protected browser sessions, AI identities, and vault credentials from the product controls that manage them. For account-level deletion, use the public deletion-request page. Some security, billing, or transaction records may need limited retention for fraud prevention, accounting, disputes, legal compliance, or reliable deletion/synchronization.
Contact
Golden Physics Project, Ontario, Canada. Privacy questions: dtoupin@goldenphysics.org.
Home · Terms · Support · Delete account