Privacy Policy for Vault: Private Photos & Videos
Last updated: April 13, 2026
Controller and contact
This privacy policy applies to the Vault mobile application ("Application") created and operated by Piotr Sochalewski. For privacy questions or requests, contact: psdevsupport@icloud.com.
Summary
The Application is designed to store photos, videos, notes, and related private content locally on your device. Piotr Sochalewski does not operate a server for your Vault content and does not have access to the photos, videos, notes, PIN, or biometric data stored in the Application. The Application uses limited third-party services for analytics, crash diagnostics, and purchase entitlement management.
Information processed in the Application
- Vault content stored locally. Photos, videos, notes, thumbnails, albums, favorites, import dates, and related metadata are stored on your device. Photos and videos may include metadata already present in the media file, such as creation date, camera information, and location metadata embedded in the file. This content is used to show, organize, protect, share, export, or delete your Vault items.
- PIN and biometric unlock settings. The Application stores a PBKDF2 hash of your PIN with a per-install salt, not the plain text PIN. Face ID and Touch ID authentication are handled by iOS through LocalAuthentication; the Application receives only the authentication result and does not receive or store biometric templates.
- Camera, microphone, and Photo Library permissions. The Application asks for camera and microphone access when you take photos or videos in the Application. It asks for Photo Library access when you import items from or export items to your Photo Library. If you enable deletion of imported items, the Application may ask iOS to delete the selected source assets from your Photo Library after import.
- Intruder Detector photos. If the paid Intruder Detector feature is active and you enable it, the Application may take a photo after successful or unsuccessful unlock attempts. These photos are stored locally in the Application's documents directory with iOS file protection and are automatically removed after 14 days.
- Analytics data. The Application uses Google Analytics for Firebase to understand basic product interaction. Custom analytics events include app unlock method, photo or video added, album added or removed, album viewed, and asset sharing type. Custom analytics events do not send the content of your photos, videos, or notes.
- Crash and diagnostics data. The Application uses Firebase Crashlytics to diagnose crashes and improve stability. Crashlytics may process crash traces, app version, operating system version, device model, installation identifiers, timestamps, and other diagnostic information needed to understand a crash.
- Purchase entitlement data. The Application uses RevenueCat to manage purchases, restore purchases, and check whether paid features such as Intruder Detector are active. RevenueCat may process purchase and entitlement status, anonymous app user identifiers, product identifiers, device/app information, and related transaction information needed to provide the purchase functionality.
- Support communications. If you contact support by email, your email address and message are processed to respond to your request.
Information the Application does not process
The Application does not sell personal data and does not use third-party advertising SDKs. The Application does not upload your Vault photos, videos, notes, or PIN to Piotr Sochalewski's servers. Your device settings, operating system, Apple services, backups, and any share/export actions you choose may still affect where your data is stored outside the Application.
Purposes and legal bases
- Providing app functionality. Vault content, local settings, permissions, PIN hash, biometric unlock result, and purchase entitlement status are processed to provide the features you request. The legal basis is performance of the app functionality requested by you and, where applicable, legitimate interests in operating the Application.
- Analytics and product improvement. Analytics data is processed to understand usage and improve the Application. The legal basis is legitimate interests in maintaining and improving the Application, unless consent is required by applicable law.
- Crash diagnostics and security. Diagnostics data is processed to find and fix crashes and maintain app reliability. The legal basis is legitimate interests in keeping the Application secure and reliable.
- Purchase management. Purchase entitlement data is processed to provide, validate, and restore paid functionality. The legal basis is performance of purchase-related functionality and legitimate interests in preventing misuse and maintaining paid features.
- Support. Support communications are processed to respond to your request. The legal basis is legitimate interests in providing support and, where applicable, taking steps requested by you.
- Legal compliance. Data may be processed when necessary to comply with applicable legal obligations.
Third-party services
Sharing and international transfers
Data is shared with the service providers listed above only as needed to provide analytics, diagnostics, Apple platform functionality, and purchase entitlement management. Google, RevenueCat, and Apple may process data in countries other than your country of residence. Where required, transfers rely on mechanisms made available by those providers, such as applicable data processing terms, standard contractual clauses, or other recognized transfer mechanisms.
Retention
Vault content and local settings remain on your device until you delete them in the Application, delete app data, or uninstall the Application. Intruder Detector photos are automatically removed after 14 days. Support emails are retained only as long as needed to handle the request and any related follow-up. Purchase records are retained by Apple and RevenueCat according to their policies and as needed to provide purchase restoration and entitlement checks. Firebase Crashlytics retains crash reports and associated identifiers for a limited period described by Firebase, currently 90 days before deletion begins. Google Analytics for Firebase data is retained according to the Firebase/Google Analytics retention settings and policies.
Your choices and rights
You can delete Vault photos, videos, notes, albums, and Intruder Detector photos in the Application. You can manage camera, microphone, Photo Library, Face ID, and Touch ID permissions in iOS Settings. You can stop further local processing by uninstalling the Application. If you are in the EU/EEA, UK, or another jurisdiction with privacy rights, you may have rights to request access, correction, deletion, restriction, portability, objection, or withdrawal of consent where processing is based on consent. You may also have the right to lodge a complaint with your local data protection authority. To exercise rights concerning data controlled by Piotr Sochalewski, contact psdevsupport@icloud.com.
Children
The Application is not directed to children and is not used to knowingly solicit personal data from children.
Security
The Application uses local access controls, PIN protection, iOS biometric authentication where enabled, PBKDF2 PIN hashing, and iOS file protection for saved media where implemented. No security method is perfect, and device-level security also depends on your device settings and Apple platform protections.
Changes
This policy may be updated from time to time. The "Last updated" date above shows when the current version was published.