Law enforcement requests

What we can never provide

Novash is built so that we never have the keys to your vault. We do not have your master password or your recovery key, and we cannot read, decrypt, or hand over readable vault contents. We do not build back doors into Novash, and we would not have a way to unlock a vault even if asked.

What we may hold

Depending on the account, we may hold limited account data, such as:

• the account email address and when the account was created;
• whether a subscription is active;
• the list of signed-in devices and when they were last seen;
• the type and time of recent account events, and any IP address recorded with them;
• the encrypted vault, which nobody but the account holder can read.

We keep this data only for the periods in our Privacy Policy, so older records may no longer exist.

How we handle requests

• We disclose account data only in response to a valid, legally binding request that applies to us, and only the data that request requires.
• We review every request and push back on requests that are unclear, too broad, or not valid.
• We tell the affected user before disclosing their data, unless the law forbids it or there is an emergency.
• In an emergency involving a risk of death or serious physical harm, we may share limited data where the law allows it.

How to send a request

Send requests from an official address to support@novash.app, with the legal basis, the issuing authority, and the account email address it concerns. Novash is operated from Libya, so a request from another country may need to go through the proper international legal channels.