This page documents how ClearCiviQ protects your data: the architecture, how your vault is encrypted, the complete list of what we store, and the things we have deliberately built ourselves out of being able to see.
Last updated: August 14, 2026
Everything you store in ClearCiviQ is encrypted on your device before it leaves. Your passphrase never travels to us. The key derived from it never travels to us. Our servers hold ciphertext that is mathematically unreadable without a key that only exists on your phone. This is not a setting you enable. It is the only way the product works.
The default for every field is: do not store it. We keep a one-way hashed sign-in identifier, your subscription tier, and account timestamps. No email. No name. No password database. A breach of our systems would yield encrypted blobs and hashes that are useless to an attacker.
Before your goal text reaches our AI provider, identifiers like names, addresses, and SSNs are redacted on your device, then checked again server-side.
Your inputs are used to generate your roadmap and nothing else. We do not use your data to train AI models, and our agreements with providers prohibit it.
Deleting your account destroys the encrypted blobs tied to it, and without the key that is irreversible by anyone, including us. Deletion is immediate when you confirm it with your passphrase. If you have lost both your passphrase and your recovery key you can still schedule it, and it completes after a 30-day waiting period that any successful unlock cancels.
No proprietary crypto. Every primitive we use is an open, standard, widely reviewed one. We describe what they do rather than publishing a parts list.
We name properties rather than specific algorithms and versions. The security of this design rests on keys we do not hold, not on which primitives we picked, and a published parts list mainly helps someone deciding where to aim.
Production access is restricted to managed identities with narrowly scoped permissions. Secrets live in a hardware-backed vault, never in code, configuration files, or developer machines.
Infrastructure health, anomalous traffic, and abuse patterns are monitored around the clock. Monitoring covers system behavior, never the contents of your encrypted data, which we cannot read.
Every change is blocked from shipping unless static analysis, dependency and code scanning, and an authenticated dynamic scan against the running service all pass. Findings are remediated on a severity-based timeline, and accepted risks are recorded with an expiry date rather than waived silently. We do not currently publish a third-party penetration test; when we commission one we will say so here rather than imply it.
We work with a deliberately small set of service providers, and we name them. Apple provides sign-in and billing through the App Store. RevenueCat records which subscription plan an account holds; it receives an opaque account identifier and subscription status, never your name or vault contents. Anthropic, our AI provider, receives only PII-scrubbed goal text and, with your explicit consent, a record number you asked us to monitor. Microsoft Azure runs our servers and stores ciphertext it cannot read. Expo delivers app updates and brokers push notifications; it receives a push token and your device platform, never your name or vault contents. On this website only, Google Fonts serves the typeface and Formspree receives launch-list signups. No analytics brokers. No data resellers. This is the current and complete list.
In the event of a security incident affecting your data, we will notify affected users and regulators as required by applicable state law. Because of the zero-knowledge design, the blast radius of any breach is limited to hashes and ciphertext.
ClearCiviQ is built to comply with the full body of U.S. state privacy law, including California's CCPA/CPRA, Illinois BIPA, Virginia CDPA, Colorado CPA, Texas TDPSA, and the comprehensive laws of more than a dozen other states. Our architecture makes much of this straightforward: rights like deletion and access are easy to honor when the data held is minimal and the rest is encrypted beyond our reach.
We welcome good-faith security research. Report findings privately and we commit to acknowledging within 48 hours, keeping you informed through remediation, and never pursuing legal action against good-faith research.
security@clearciviq.appPlease include reproduction steps. Do not access other users' data or degrade the service.