Foxcolab
FoxcolabE2EE Worksuite
Privacy Policy

Privacy Policy

Last Updated: June 5, 2026. At Foxcolab Technologies, we believe privacy is a fundamental human right. Our platform is mathematically architected to ensure that your communication belongs strictly to you.

1. Zero-Knowledge Cryptography

Foxcolab Technologies operates under a **Zero-Knowledge** architecture for E2EE services (including Foxcolab Mail, Foxcolab Notes, Foxcolab Drive, Foxcolab Calendar, Foxcolab Docs, Foxcolab Forms, and Foxcolab Meet/Messenger). For these services, the content of your communications and documents is encrypted on your local device before transmission to our servers.

For **Foxcolab Workspace**, communications are secured using industry-standard transport-layer encryption and encrypted at rest on our secure servers. This facilitates core team collaboration tools such as server-side indexing, bot integrations, global workspace search, and cross-channel notifications.

  • Zero Server Visibility (E2EE Services): For our end-to-end encrypted products, plaintext data and raw cryptographic keys never reach our servers. Encryption keys are generated locally and stored exclusively in active browser memory (RAM) or derived on-the-fly using secure key derivation algorithms.
  • Secure Protocols: Standalone chat via Foxcolab Messenger utilizes advanced cryptographic protocols with rotating key mechanisms for perfect forward secrecy.
  • Mail Encryption: E2EE emails in Foxcolab Mail are encrypted locally prior to transmission and storage.
  • Loss of Password: Because we do not hold your private keys or passwords in plaintext or decryptable forms, **we cannot recover your password or restore access to your encrypted data** if you lose both your master password and your single Recovery Key.

2. Data We Collect & Process

To run the Foxcolab platform, we must collect and process certain account-related metadata. We categorize the collected information as follows:

A. Account Identity Details

We collect your first name, last name, primary email address, date of birth, recovery email address, and mobile phone number. This metadata is stored unencrypted on our servers to verify your identity, send security notifications, and recover accounts.

B. Credentials & Keys

We store strongly hashed passwords to authorize access. For E2EE products, we store your symmetrically-encrypted private key (encrypted in the browser prior to upload) and public keys.

C. Billing & Payment Information

Transactions are processed via secure authorized payment gateways. We do not store raw credit/debit card numbers on our servers. We store tokenized payment IDs, billing profile addresses, subscription status, and tier entitlements.

D. Diagnostics, Logs & Telemetry

We track numerical storage quotas (e.g., GB used in Foxcolab Drive), member limits, and basic telemetry (e.g., message count for billing tiers) using our centralized metrics engine. IPs are stored temporarily in our secure in-memory cache solely to prevent DDoS attacks and enforce login rate limits.

3. Legal Basis & Data Usage

We process your information under the following legal bases:

  • Performance of a Contract: To set up, authenticate, maintain, and bill your team workspace.
  • Legitimate Interests: To detect and block malicious traffic, enforce service limitations, and verify OAuth logins.
  • Consent: When you upload a profile picture or willingly populate optional profile parameters.

We use the metadata we collect to provide and improve the Services, process payments, protect our platforms against abuse, and provide support. We do not scan or profile your data for advertising.

4. Third Parties & Subprocessors

We do not sell, rent, or trade your data. The encrypted blobs stored on our servers are completely unreadable by third parties. Metadata is only shared with standard utility partners necessary for operations:

  • Infrastructure & Hosting: Our cloud compute nodes, secure storage providers, and managed databases.
  • Payment Processor: Secure payment processors, for transaction fulfillment and subscriptions.
  • Legal Compliance: We will only disclose metadata if required by a binding legal warrant. We cannot disclose decrypted communication payloads under any circumstance because we do not have the keys to decrypt them.

5. Data Retention & Deletion

We retain account metadata, workspace assets, and encrypted files for as long as your account is active or needed to provide services.

If you terminate your account, all associated encrypted database files, databases indexes, message histories, and metadata are permanently removed from our active production clusters within 30 days. Backups are completely overwritten within 60 days.

6. Regulatory Rights (GDPR & CCPA)

Under regulations like the **GDPR** (General Data Protection Regulation) and **CCPA** (California Consumer Privacy Act), you hold the right to access, rectify, export, or permanently erase your metadata:

  • Right to Access: You can request a copy of the metadata we hold about you by emailing us.
  • Right to Rectify & Erasure: You can edit profile parameters directly from the client panel or delete your account, triggering automatic data purging.
  • Right to Object & Restrict: You have the right to object to the processing of your metadata under certain legitimate interests.

To request a complete export of your account metadata or invoke a formal erasure request, contact us at **privacy@foxcolab.com**.

7. Children's Privacy

Our Services are not designed for or targeted at children under the age of 13 (or 16 in certain European jurisdictions). We do not knowingly collect personal metadata from children. If we discover that a child has provided us with personal metadata, we will delete it immediately from our servers.