Privacy Policy — JC Laboratories LLC

Effective August 2026 · JC Laboratories LLC / jclabs.tech

    Cryptaverse holds content in three states, and you choose which. Private content — your vault, profile screen, posts, private groups, messages, and unshared Drive folders — is encrypted on your device before it reaches us, and we cannot read it. Shared Drive folders stay encrypted; redeeming a share link performs a key exchange that gives that person the folder key, and we still cannot read the files. Public content — blocks and stacks you publish, a public profile, and the listing details of a public group — is stored unencrypted, because it is meant to be read. Nothing moves between these states without you doing it.
  

Who We Are

JC Laboratories LLC (jclabs.tech) is an independent technology company registered in Michigan, United States. We develop security-focused software, including Cryptaverse and the Entropy-Gated AI Framework (EGAF).

Our Products

Cryptaverse (formerly Aleph Vault)

A privacy-first encrypted vault, messenger and publishing application for Android. Cryptaverse provides local encrypted storage of notes, passwords, cryptographic key pairs and API keys; post-quantum encrypted messaging; encrypted file transfer; and a public publishing surface for blocks and stacks.

Private data is encrypted on-device using AES-256-GCM. Messaging uses a hybrid post-quantum key exchange (ML-KEM-768 with X25519) and a Double Ratchet, with Ed25519 signatures. We cannot read your vault contents, your private profile screen, or your messages.

Content you choose to publish to the public Blocks tab, including any images or video attached to it, is stored unencrypted so that it can be served to and read by other people. Publishing is always a deliberate action you take.

EGAF — Entropy-Gated AI Framework

An open AI governance protocol developed by JC Labs R&D, defining what an AI assistant is permitted to do before it runs so that behaviour is bounded and auditable. EGAF is built into Abe rather than shipped separately, and is being rebuilt alongside it.

EGAF is licensed under CC BY-NC 4.0. Commercial implementations require written permission from JC Laboratories.

Abe (formerly the Gaffer) — in development

Our AI assistant built on the Entropy-Gated AI Framework. Abe is currently offline while it is reworked, and is not accepting traffic. This section describes how it will operate when it returns.

Messages sent through Abe are processed by third-party AI providers subject to their own privacy policies and retention practices. We do not store conversation logs on our servers; each session is processed without persistent storage by JC Laboratories.

Third-party providers: Anthropic, Groq, OpenAI.

What We Collect

Account. Your email address is used for account creation, sign-in and password reset only. It is not stored as plaintext. We store a keyed cryptographic representation (HMAC-SHA256) for account lookup, which cannot be reversed to recover the original address. We also store a password verifier (PBKDF2-SHA256, 600,000 iterations, salted), account creation and last sign-in timestamps, failed sign-in counters used for lockout, and session token records.

Identity. A public key fingerprint derived on your device, your subscription tier, storage usage counters, and — if you enable push notifications — a device notification token. Your private keys are generated on your device, stored in Android hardware-backed storage, and are never transmitted to us.

Published content. If you publish a block or a stack, we store its content, its type, searchable text extracted from it, a small preview image, and any media attached to it. This is stored unencrypted. If you enable comments, follows or reactions on published content, we store those interactions and the fingerprint of the person who made them. If you publish a public profile, we store the display name, biography and picture you chose.

Encrypted content we hold but cannot read. Messages awaiting delivery, Relay file transfers, Drive files, Safety Deposit Box backups, contact requests and acceptances, and group key material. All of this is encrypted on your device before upload. We store ciphertext and routing metadata only — sender and recipient fingerprints, sizes, and timestamps — which we need to deliver it.

Operational. Search quota counters, storage quota counters, subscription and payment records held by our payment processor, and rate-limiting counters keyed to IP address, which expire within minutes to hours and are not retained beyond that window.

We do not collect your vault contents, private keys, private profile screen, notes, passwords, or API keys in readable form — on any tier.

Cryptaverse — Data by Tier

We collect the same categories of data on every tier. Tiers differ only in how much you may store and how much you may publish, not in what we hold or what we can read.

Tier	Storage	Cloud backup
Free	1 GB	Not available — vault data never leaves your device
Personal	50 GB	Safety Deposit Box, encrypted on your device before upload
Pro	250 GB	Safety Deposit Box, encrypted on your device before upload

Safety Deposit Box backups are encrypted on your device before upload and cannot be decrypted by JC Laboratories. Storage is a single shared allowance across backups, Drive files, Relay transfers, published media, profile delivery and undelivered messages.

How We Use Your Information

To create, secure and manage your account
To deliver encrypted messages, files and profile updates to the people you send them to
To serve content you have chosen to publish, and to make it findable in search
To enforce subscription tier features, storage limits and search quotas
To send push notifications you have enabled
To communicate service updates (opt-in only)
To maintain service security and prevent abuse

We do not sell your data. We do not use your data for advertising. We do not build advertising profiles. We do not share your data with third parties except as needed to operate the services described here, or as required by law.

Data Storage and Security

Account and application data is stored in Cloudflare D1 (edge SQL) and Cloudflare KV (edge key-value store). Encrypted blobs, published media and public profiles are stored in Cloudflare R2. This infrastructure is operated by Cloudflare, Inc. under their own privacy and security policies. Payments are processed by Stripe, Inc.; we do not receive or store card details.

Private keys are generated on your device and held in Android hardware-backed storage. They are never transmitted to or stored on our servers. Because of this, we cannot recover your vault if you lose your vault password and have no backup.

We do not store IP addresses in our application database beyond short-lived rate-limiting counters. Network-level logs may be retained by infrastructure providers under their own policies.

Data Retention

Account data — retained until you delete your account
Published blocks, stacks and their media — retained until you unpublish them or delete your account
Comments, follows and reactions — retained until deleted by their author or the owner of the content, or until the account is deleted
Public profile — retained until you withdraw it or delete your account
Undelivered messages — automatically deleted at expiry
Relay transfers — deleted on acknowledgement of receipt, or at expiry
Drive files and Safety Deposit Box backups — retained while your subscription is active, deleted 30 days after cancellation
Session tokens — expire within 7 days, or immediately on sign-out
Rate-limiting counters — expire within 15 minutes to 24 hours depending on the endpoint

All of it goes when you delete your account. Every record we hold in our database and every file we hold in object storage is keyed to your account or your key fingerprint, and deleting your account removes all of it. Nothing is retained for our own purposes afterwards.

Deleting Your Account

You can delete your account and everything we hold for it in two ways:

In the app — Settings → Delete Account
On the web — jclabs.tech/delete-account.html, which works even if you have uninstalled the app. We send a confirmation link to your registered email address; nothing is deleted until you open it and confirm.

Deletion removes your account and credentials, published blocks and stacks and their media, comments, follows and reactions (both yours and those others left on your content), your public profile, undelivered messages, Relay transfers, Drive files, Safety Deposit Box backups, and any groups you created — which are removed for every member. It cannot be reversed.

Your encrypted vault is held on your own device and is never sent to us, so account deletion does not reach it. Remove the app to clear local data.

Your Rights

Most of these are controls in the app, and they are yours to use. You do not need to ask us, and we do not act on your content on your behalf.

Unpublish any block or stack at any time, in the app
Revoke a Drive folder link at any time, in the app — this prevents further redemptions, but does not remove access from anyone who already redeemed it
Delete your account and everything we hold for it, in the app at Settings → Delete Account or on the web at jclabs.tech/delete-account.html
Request a copy of the data we hold about you, by writing to us
Opt out of non-essential communications

If you have published a public profile, deleting your account removes it. A way to withdraw a public profile on its own, without deleting your account, is not yet available in the app — until it is, write to contact@jclabs.tech and we will remove it for you.

For anything not handled by a control in the app, write to contact@jclabs.tech.

Children

Our services are not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact contact@jclabs.tech and we will delete the account promptly.

Changes to This Policy

Material changes will be communicated via the app, this website, or email. Continued use after changes constitutes acceptance.

Contact

contact@jclabs.tech · jclabs.tech