This is a translation. In case of any discrepancy, the Romanian version at /ro/termeni/ prevails, as the contract is governed by Romanian law.
Who provides the service
Amprenta Digitală is operated by the Cyber Security Education Association (Asociația Educație în Securitate Cibernetică), a non-governmental, non-profit organisation founded in 2023, registered at 50 Linia de Centură Street, Ștefăneștii de Jos, Ilfov County, Romania, tax ID 48106635.
By creating an account you accept these terms. If you do not agree with them, do not use the service. We do not ask you to accept anything you cannot read first.
What the service is
An online vault for your files, notes and documents, encrypted on your own device before they reach us. The encryption key is computed from your password, in your browser, and is never transmitted to us.
The consequence is simple and you must understand it before paying: without your password, neither you nor we can open the vault.
What the service is NOT
- It does not open your vault for anyone after your death. There is no mechanism that detects that you have died and forwards the key to an heir. If you want your family to be able to get in, you must give them the recovery code yourself, while alive.
- It is not a will and produces no legal effects of succession. A note left in the vault does not replace a notarial deed.
- It is not a sync service and has no desktop application. Access is through the browser.
- It does not allow sharing between accounts. You can generate a public link with the key embedded in the address, but you cannot grant another user access to your vault.
- It is not a bank safe deposit box. We are not a credit institution nor an authorised depositary.
Your account and password
You are responsible for keeping your password. A good password means long, and used only here. Never send us your password, through any channel, and we will never ask for it. If you receive a message asking for your password, it is not from us.
One account, one person. Do not sell, lend or transfer the account.
The recovery code
At sign-up you receive a recovery code generated on your device, which you print. It is the second and only route to the vault key. We generate it once, we do not store it in usable form, and we cannot regenerate it on your behalf.
The account cannot accept file uploads until you confirm you have printed the code. This is not a formality: it is the only thing standing between you and permanent data loss.
Keep it where you keep your important documents. If you want someone close to you to be able to get in when needed, tell them where the code is. Anyone holding the code can open the vault.
If you lose your password
With the recovery code, you set a new password and your data stays intact.
Without the recovery code, the data is permanently inaccessible. There is no recovery procedure, no exception for special cases, and it does not matter whether you can prove you own the account. This is not a limitation of our support, it is the direct consequence of how the service is built. The only remaining option is deleting the account and starting over.
Plans, prices and payments
Prices are shown in euro on the pricing page and are those valid at the time of purchase. The association is not registered for VAT, so displayed prices are final. Payment is processed by Stripe Payments Europe. We never see or store your card details.
- Demo: 30 MB, free, with a confirmed email address. No link sharing. Deleted after 12 months of inactivity, with three prior notices.
- Annual plan: renews automatically every 12 months until you cancel. Cancellation takes effect at the end of the paid period.
- Single payment for 10 years: secures the plan for 120 months from the date of payment. We notify you 11 months before expiry.
- Extra space: sold in 5 GB blocks, billed annually, even if the base plan was paid once for 10 years.
Your purchased space and what happens if you exceed it
We let you upload up to 150% of your purchased space. Beyond that, uploads are refused.
Used space includes live files, versions kept in history, the contents of the trash, and thumbnails. You can see the breakdown in your account.
From the moment you exceed your purchased space, you have 30 days to get back within it. We send notices on days 1, 8, 15, 26 and 30. On day 30, if you are still over, we automatically delete files until you fit, in this order: first files not marked as favourites, oldest modified first; then, if that is not enough, favourites as well.
Deletion is permanent and does not pass through the trash. We cannot choose what to keep on your behalf, because we cannot see the content. Your alternatives are to buy extra space or delete what you no longer need; your account includes an assistant showing your largest files, duplicates and old versions.
Cancelling your subscription
On cancellation, the account moves to the Demo plan, 30 MB, at the end of the paid period. If your data exceeds 30 MB, the procedure in section 8 applies: 30 days of grace, then automatic deletion of the oldest files. We send three notices beforehand.
Your content and your responsibility
The content remains yours. We do not use it, analyse it, sell it or give it to anyone. We could not, even if we wanted to: it is encrypted with a key we do not hold.
For the same reason, we cannot check what you upload and we do not. Responsibility for the legality of the content is entirely yours. Using the service for material whose possession is illegal in Romania or the European Union is prohibited. If we receive a substantiated report we may suspend the account, but we can neither confirm nor deny the content.
What we can provide in response to a lawful request
In response to a lawful request from a competent authority we can provide only what we actually hold: the email address, the billing data held by Stripe, IP addresses and country from access logs, timestamps of account actions, file sizes, and the encrypted blocks as we store them.
We do not hold the decryption key, so we cannot provide readable content. Not on request, not under legal compulsion, not for a fee. This is not a stance of defiance towards authorities, it is a technical impossibility that follows from the architecture.
A technical limit you should know about
The encryption runs in the JavaScript code that we deliver to you, through the browser. If we were legally compelled or compromised, we could in theory deliver a modified version that transmits your password at your next sign-in. No web architecture eliminates this risk entirely, and any service claiming otherwise is misinforming you.
What we do about it: we publish the cryptographic digests of the code bundles, we use Subresource Integrity, and the code performing the encryption is public. For the most sensitive material, we sincerely recommend encrypting locally with an independent tool and uploading the result.
Deleting your account
You can delete your account at any time from settings. We first delete the wrapped key, which makes the data mathematically unrecoverable instantly, including for you. You receive a deletion certificate by email. Encrypted blocks are physically removed from disk within 7 days.
What remains is only what the law requires us to keep: accounting records for payments, and the audit log, which contains only identifiers and timestamps, never content.
Availability and limitation of liability
We strive to keep the service available but do not guarantee uninterrupted operation. Maintenance is announced in advance.
We are not liable for data loss caused by loss of your password or recovery code, by exceeding your space followed by the automatic deletion described in section 8, by compromise of your device or email account, or by your own disclosure of the password or recovery code.
To the extent permitted by law, our total liability is limited to the amount you paid in the last 12 months. The service does not replace your own backup. For data you cannot afford to lose access to, keep a copy elsewhere as well.
Continuity of the service
A vault is bought for the long term, sometimes for ten years, so we state upfront what happens if the association can no longer operate the service:
- we give at least 90 days notice, by email and on the site;
- full export remains available throughout the notice period;
- we publish the decryption client code, so that with your exported blocks and your password you can recover your data without us;
- for plans paid for 10 years, we refund the unused period pro rata, within the association's available funds.
Changes to these terms
If we change these terms in a way that disadvantages you, we notify you 30 days in advance by email. If you disagree, you may cancel and we refund the unused period.
Governing law and dispute resolution
Romanian law applies. If you have a complaint, write first to contact@amprentadigitala.ro and we reply within 5 working days. You also have the right to contact the Romanian National Authority for Consumer Protection, or to use the European online dispute resolution platform. Romanian courts have jurisdiction.
Contact
Cyber Security Education Association
50 Linia de Centură Street, Ștefăneștii de Jos, Ilfov County, Romania
Tax ID 48106635
Email: contact@amprentadigitala.ro
Security: security@amprentadigitala.ro