Gun Vault

Privacy Policy

Last updated: October 29, 2026

Gun Vault is an invite-only Southland Labs project for private firearm recordkeeping. It is currently experimental software for limited invited use, operated from Texas and powered by Cloudflare infrastructure. This Privacy Policy explains what information is collected, how it is protected, who can access it (and who cannot), and what you are responsible for. Please read it carefully.

The core principle behind Gun Vault's privacy design is simple: your vault data belongs to you and is encrypted at rest. The current service performs encryption and decryption on the server for authenticated requests; it is not a zero-knowledge or end-to-end encrypted system.

What We Collect and Why

Gun Vault collects only information that is necessary to provide and protect the service. This falls into two categories: information you provide, and technical security data generated automatically during use.

Information You Provide

When you create an account and use Gun Vault, you may provide the following categories of information:

Account information: Your name, email address, and password authentication data. Names and email addresses are operational account metadata and are not encrypted with your per-account vault key. Passwords are stored only as salted hashes; plaintext passwords are never stored.

Optional identity information: Driver license information and License to Carry / Concealed Weapons License (LTC/CWL) details, if you choose to provide them. This information is encrypted at rest and is not exposed through normal support tools.

Firearm records: Serial numbers, firearm makes and models, categories, calibers, possession status, possession dates, modifications, and notes associated with each firearm you choose to record.

Supporting media and documents: Photos and uploaded documents you attach to firearm records or your profile.

Service interactions: Support tickets, invite records, export requests, and secure erase requests you submit.

Sensitive vault content—firearm records, identification numbers, photos, documents, and support-ticket contents—is encrypted at rest using AES-256-GCM before it is stored. Account and security metadata is handled separately as described below.

Security and Technical Data

Gun Vault automatically records technical security data as part of operating and protecting the service. This includes: IP address, device and browser metadata, login attempt records, two-factor authentication challenge events, support failure identifiers, rate-limit counters, session records, remembered-device token metadata, reset-token metadata, admin action audit logs, and cookie notice acceptance status.

This technical data is operational in nature and is used to detect abuse, enforce rate limits, maintain session integrity, and support account recovery workflows. It is not used for marketing, advertising, or profiling. Admin audit logs are retained in the active application database for up to 90 days and then automatically deleted, subject to the provider-backup qualification below.

Vault Encryption — AES-256-GCM

Sensitive vault data is encrypted at rest using AES-256-GCM (Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode), an authenticated-encryption algorithm that protects both confidentiality and integrity.

How it works: Each Gun Vault account is assigned its own unique vault key. Your vault data is encrypted using this key before it is written to storage. The vault key itself is stored in encrypted form using server-side secret material maintained within Cloudflare's secrets infrastructure — meaning the vault key is never stored in plaintext, and your vault data is never stored in plaintext. Your data is decrypted only during an active, authenticated session when you request it, and that decryption happens in response to your legitimate authenticated request only.

What this means in practice: A database-only compromise would expose ciphertext rather than readable vault fields. Because the service currently holds the server-side secret needed to unwrap account vault keys, an attacker or operator with access to both that secret and the encrypted database could decrypt vault data. Access to production secrets is therefore tightly restricted.

The following specific data categories are protected by AES-256-GCM encryption at rest: firearm serial numbers, firearm records and details, owner identification numbers (driver license, LTC/CWL), photos, uploaded documents, calibers, possession dates, notes, and modifications. These vault fields are encrypted individually at the field or object level using your account's vault key. Account names and email addresses remain operational metadata outside that vault encryption boundary.

Staff and Support Access

Routine support tools do not display firearm records, uploaded photos, documents, or owner identification fields. Account support actions require authorization controls and are logged. Authorized operators who control both production secrets and database access could technically decrypt vault content, so Gun Vault does not claim to be zero-knowledge.

Users should keep independent copies of important records and protect their account, email, authenticator, remembered devices, exports, and downloaded vault-key backup.

Your Key Responsibility

The security and recoverability of your account also depend on the controls you maintain. You must keep secure control over all of the following:

Your password: Use a strong, unique password that you do not reuse elsewhere. If your password is lost or compromised, your account may be inaccessible or exposed, respectively.

Your email account: Password resets, 2FA resets, support codes, and other critical account actions are delivered to your registered email address. A compromised email account is a critical risk to your Gun Vault account. Protect your email with its own strong password and two-factor authentication.

Your authenticator app: If 2FA is enabled, your authenticator is required for login. Losing access to your authenticator without a backup recovery path may permanently lock you out of your account.

Trusted devices: Non-administrator accounts may store a time-limited remembered-device token that avoids a 2FA prompt on later password sign-ins. The service also requires the browser identifier recorded with the token, but this is not a cryptographic hardware or network binding and can be imitated. Sign out to revoke it if a device is lost or compromised. Administrator accounts cannot use remembered-device bypass.

Your downloaded vault key export: You may download the current raw vault key. Treat it as an extremely sensitive advanced-recovery artifact and store it securely. Anyone who obtains the key and corresponding encrypted database content may be able to read that data. The service does not currently provide an in-app key-restore workflow, and an older key will not decrypt records re-encrypted after rotation.

Downloaded exports: Spreadsheets, PDFs, database exports, and any other files you download from Gun Vault contain decrypted vault data. Once downloaded, these files are your responsibility. Southland Labs has no ability to track, protect, or revoke them after download. Delete them securely when no longer needed.

Normal support workflows cannot display vault contents. Maintain independent, secure backups of any records that matter to you.

Cookies

Gun Vault uses essential cookies only — the minimum necessary to operate the service securely. No third-party tracking, advertising, or analytics cookies are used.

The cookies Gun Vault uses include login session cookies, 2FA challenge cookies, and optional remembered-device tokens. The cookie-notice dismissal is stored in your browser's local storage for approximately 3 months. Server-side rate limits use request and account metadata rather than a separate rate-limiting cookie.

Cookies are never used for marketing, advertising, ad targeting, cross-site tracking, user profiling, or any purpose unrelated to the secure operation of your Gun Vault account. No cookie data is sold, shared with advertisers, or provided to third parties for commercial purposes.

Two-Factor Authentication (2FA) and Remembered Devices

Two-factor authentication is strongly recommended for all regular accounts and is mandatory for administrator accounts. Enabling 2FA substantially reduces the risk that a compromised password will result in unauthorized account access. If you choose not to enable 2FA on a non-administrator account, you explicitly accept a higher risk of account compromise and take full personal responsibility for any resulting consequences.

Remembered-device tokens, when used by non-administrator accounts, are time-limited security cookies that reduce the frequency of 2FA prompts. A copied token replayed with the recorded browser identifier could be used until it expires or is revoked, so protect it like a login credential. You can revoke it by signing out or from the active-sessions panel.

Support Limits and Staff Access

Support access is limited: sensitive account support actions require a support PIN or emailed code, and normal support tools do not expose encrypted vault records.

When you submit a support ticket, that ticket may include your name, email address, issue category, your message, your IP address, relevant error codes, and device metadata. Support ticket contents are used solely to address your support request and are not used for any other purpose.

Authenticated users are limited to a small number of support tickets per month to reduce abuse. Administrative actions are access-controlled and audited.

Email Communications

Gun Vault sends transactional emails necessary to operate the service. These are sent from no-reply@gunvault.southlandlabs.dev and include invitation emails, welcome emails, reset links, support codes and ticket updates, secure-erase notices, and administrator 2FA setup emails.

These emails contain links or codes that are used to complete important account actions. They should be treated as sensitive. Do not forward them, share them, or leave them accessible to others. If you receive an email you did not request, treat it as a potential security alert and review your account activity promptly.

Gun Vault does not send marketing or promotional emails. You will only receive emails that are directly related to your account activity or security.

Exports and Downloads

Spreadsheet, PDF, vault key backup, and database exports are generated on demand at the time of your request using your current decrypted vault data. These files are not permanently stored or retained by the service after they are made available for download.

Once you download an exported file, you are fully and solely responsible for protecting it. Exported files contain your decrypted vault data and must be treated with the same care as any highly sensitive personal document. Store them encrypted, limit access to them, and delete them securely when they are no longer needed. Southland Labs has no ability to revoke, encrypt, or otherwise protect files once they have been downloaded.

Retention and Secure Erase

Active account and vault records are retained for as long as your account remains active. If you request secure erase, the process requires successful password and authenticator verification (where applicable), after which your account login is blocked, a cancellation link is emailed to your registered address, and a 24-hour waiting period begins. If the erase is not canceled before the waiting period expires, the application deletes the account's records and active vault key, randomizes remaining account fields, and disables the account.

Trash records—items moved to the trash but not yet deleted—remain recoverable for 7 days. They are then automatically removed from the active application database. Keep an independent backup of anything you may need later.

Certain technical and operational data — such as session records, rate-limit counters, and admin audit logs — are retained for the periods described in this policy (e.g., admin logs for up to 90 days) and then automatically removed from the active application database. Deleted data may remain temporarily in Cloudflare-managed backup, disaster-recovery, logging, or database time-travel systems until those systems' retention periods expire; those copies are not available through normal Gun Vault application or support interfaces.

Third-Party Infrastructure

Gun Vault is built on Cloudflare infrastructure, including Cloudflare Workers (serverless compute) and Cloudflare D1 (database). Cloudflare Turnstile is used for bot and abuse prevention, and Cloudflare's cdnjs network supplies the visual icon font used by the interface. Outbound email is delivered via SMTP.

These providers process technical metadata needed to deliver their services, including networking data, request metadata, email delivery data, and database operations. Vault content is encrypted at rest in D1, while the Worker decrypts it when serving an authenticated request. Southland Labs uses these providers to operate the service and does not authorize advertising or marketing use of Gun Vault data.

No third-party analytics, advertising, or tracking services are used by Gun Vault.

No Sale or Marketing Use of Your Data

Southland Labs does not sell, rent, license, or otherwise transfer Gun Vault user data to any third party for commercial purposes. Vault contents, owner identification numbers, firearm records, photos, documents, cookies, and support records are never used for marketing, advertising, profiling, or any purpose other than operating and securing the service for you.

Your firearm records are your private property. Gun Vault exists to help you manage them — not to monetize them.

Children's Privacy

Gun Vault is not intended for use by individuals under the age of 18. Southland Labs does not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us so we can take appropriate action.

Changes to This Policy

This Privacy Policy may be updated as Gun Vault changes, as required by law, or as our practices evolve. Continued use of the service after any changes to this policy constitutes your acceptance of the updated policy. We encourage you to review this policy periodically. Where feasible, material changes will be communicated to users, but it remains your responsibility to stay informed of the current policy.