Last updated: July 29, 2026
We cannot read your vaults. Encryption and decryption happen on your device, your phrase never reaches us, and there is no account and no server-side storage of your vault content. This site runs no analytics of any kind and sets no cookies. There is exactly one place where anything about you is observable, and it is spelled out below rather than buried: the optional relay server necessarily sees your IP address.
QEV encrypts messages on your device using a phrase you choose. The encrypted output (a .vault.json file) never leaves your device unless you explicitly send it somewhere. The phrase never leaves your head (or your keyboard, briefly).
Nothing from inside your vaults, and nothing that identifies you to us. One exception exists — the optional relay server, described below. It never touches your content.
secure.imagineqira.com and nowhere else. The list of files we serve is itself covered by the Ed25519-signed manifest at /verify./vault page additionally writes nothing to localStorage, sessionStorage, or IndexedDB./vault page is served with a Content-Security-Policy HTTP response header that includes connect-src 'self', so the browser refuses any connection to a third-party host. Same-origin requests remain possible — libsodium fetches its WebAssembly module that way — but nothing can reach an outside server. Do not take our word for it — read the header yourself: curl -sI https://secure.imagineqira.com/vault/ | grep -i content-security-policy. That header is scoped to the vault page; it is not a claim about every page on this site.@bryan237l/qev-cli) contains no networking code whatsoever; its only dependency is libsodium, and the published package has no HTTP, socket, or fetch call in it. The desktop app does open network connections, but only for features you deliberately invoke — device pairing, encrypted chat, and relay delivery, described in the next section — and its source contains no analytics, crash-reporting, or update-check code. The Android build's source is not in the public repository, so you cannot check it the same way; treat "no telemetry" there as our stated design intent rather than as something you or we have measured. No independent auditor has certified any of this.QEV's Phase 3 relay at secure.imagineqira.com:7892 is a store-and-forward courier. When you send a vault to a paired peer via the relay, the server sees:
The server does NOT see: your name, device label, message content, vault phrase, or any metadata inside the envelope.
On IP addresses. An earlier version of this page listed your IP address as something the relay does not see, "beyond what TCP requires." That was self-negating and we have removed it. Stated plainly: the relay sees the source IP address of every connection, because TCP cannot return a response without one. It also writes that address down — on every completed Noise XK handshake the server logs a line containing the remote IP address and port next to the sender's static public key (tauri-app/src-tauri/relay/src/service.rs, in handle_connection, at the default info log level). The operator can therefore correlate an IP address with a public key and a time.
We do not currently publish a retention or rotation policy for those server logs, so do not assume they are discarded. If IP-level unlinkability matters to you, do not rely on the relay for it: route the connection over Tor or a VPN, or skip the relay entirely and move the .vault.json file by hand through any channel you like. The vault file is self-contained — the relay is a convenience, never a requirement.
Envelopes are deleted from the relay once the recipient fetches them, and unfetched envelopes are evicted after 30 days (the relay's default retention_hours is 720; see relay/src/config.rs). The relay's deployed configuration file is not published, so treat that number as an operator commitment rather than something you can verify from outside.
Nothing you put into a vault is processed by a third party. At the site level there is exactly one, and it only applies if you install the CLI:
@bryan237l/qev-cli) is distributed via npmjs.com, and npm's own privacy policy applies to the download transaction. The CLI itself makes zero network calls once installed.Beyond that: no analytics provider, no ad networks, no tag manager, no payment processor (the software is free), and no CDN. Every asset on this site is served directly from our own server. Ten pages here did previously carry a Google Analytics tag; it was removed on 2026-07-29, and the site's Content-Security-Policy now permits no third-party host at all, so the browser would block one even if it were reintroduced by mistake.
The source code is available at github.com/TheArtOfSound/qev-desktop. The license that actually governs it is whatever the LICENSE file in that repository says — read it there rather than trusting a license name typed onto a marketing page.
Most of this page is checkable against that source: the vault page, the CLI, the desktop app, and the relay server code are all in it. Three things are not. The Content-Security-Policy header on /vault is server configuration, so read it off the live HTTP response instead. The relay's deployed config file and the retention of its server logs are operator-side, so they rest on the disclosure above. And the Android build is not in that repository at all.
QEV is not directed at children under 13. We do not knowingly collect personal data from anyone, child or adult. The one exception is the site analytics disclosed above, which we do not use to identify any visitor and which gives us no way to determine a visitor's age.
If this policy ever changes, the update will be committed to the repository with a clear diff. The Last updated date at the top of this page will reflect the change.
Questions about this policy: bryanleonard@imagineqira.com