Privacy Policy

1. Overview

Thorium ("we", "us", or "our") is a zero-knowledge, end-to-end encrypted cloud storage service. Our fundamental design principle is that we cannot read your files. Your data is encrypted on your device before it ever leaves it, and only you hold the keys to decrypt it. This Privacy Policy describes what limited information we do collect and how we handle it.

2. Information We Collect

2.1 Account Information

When you create an account we collect your email address and a salted, hashed version of your authentication credentials. We never store your plaintext password or your encryption keys.

2.2 Usage & Diagnostic Data

We may collect anonymised, aggregated usage metrics (e.g., number of sync operations, app version, crash reports) to improve the product. This data cannot be linked back to your identity or to any specific file.

2.3 Payment Information

If you subscribe to a paid plan, payment is processed by our third-party payment processor. We receive only a transaction confirmation and a subscription status — we never store full credit card numbers or banking details.

2.4 Support Communications

If you contact us for support we retain the content of that correspondence to resolve your issue and improve our service.

3. What We Cannot Access

Due to our zero-knowledge architecture, the following are technically inaccessible to us:

• The contents of any file you store or sync through Thorium
• Your encryption keys or master password
• File names or folder structure (these are encrypted client-side)
• Metadata associated with individual files

This means that even if compelled by a court order or subpoena, we have no ability to hand over your file contents — because we do not have them.

4. How We Use Your Information

The limited information we collect is used solely to:

• Authenticate your identity and manage your account
• Process your subscription and send billing receipts
• Respond to support requests
• Detect and prevent fraud or abuse
• Comply with applicable legal obligations
• Improve the reliability and performance of our service

We do not sell, rent, or share your personal information with third parties for marketing purposes.

5. Third-Party Services

Thorium integrates with third-party cloud providers (such as Google Drive, Dropbox, and OneDrive) on your behalf to store your encrypted data. We only transmit ciphertext to these providers — they cannot read your files any more than we can. Your use of those services is also subject to their respective privacy policies.

6. Data Retention

We retain your account information for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law (e.g., billing records for tax purposes, which are retained for seven years).

7. Security

We employ industry-standard security measures to protect the account information we do hold, including encryption in transit (TLS 1.3), hashed credentials, and strict access controls on our infrastructure. However, no internet transmission is 100% secure, and we encourage you to use a strong, unique password for your Thorium account.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to or restrict certain processing
• Data portability (receive a copy of your data in a machine-readable format)

To exercise any of these rights, contact us at support@thorium-security.com.

9. Children's Privacy

Thorium is not directed to children under 13 (or under 16 in the EU/UK). We do not knowingly collect personal information from children. If you believe a child has provided us with their data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice in the app at least 30 days before the change takes effect. Continued use of Thorium after the effective date constitutes acceptance of the updated policy.

11. Contact

If you have any questions about this Privacy Policy, please reach out to us at support@thorium-security.com.