Vaultis — Privacy Policy

Last updated: 2026-09-02

Who is responsible for your data

Vaultis is the publisher of the Vaultis app for iOS and Android and is the data controller for the limited personal data described in this policy.

You can reach us at privacy@vaultis.legalpage.site for any privacy question, and at support@vaultis.legalpage.site for help with the app. We answer privacy requests within 30 days.

The short version

Vaultis protects apps, files and folders on your own device. It is built so that we never see what you protect. There is no Vaultis account, no login, no cloud sync and no server that stores your content. Your passcode, the list of protected apps, your hidden items and anything you place in the encrypted vault stay on your device.

We do not use analytics tools. We do not show ads. We do not sell or share personal data. The only personal data that reaches us is the information you type into an email when you contact support.

What Vaultis keeps on your device

The following information is created and stored on your device only. It is not transmitted to us and we have no technical way to read it.

Your passcode. We never store the passcode itself. The app stores a salted hash produced with a deliberately slow key derivation function, so that the stored value cannot be turned back into your passcode.
Your recovery code. Also stored only as a hash. It is shown to you once, at setup.
Biometric settings. If you enable Face ID, Touch ID or Android biometric unlock, the check happens inside the operating system. Vaultis receives only a yes or no answer. Your fingerprint or face data never reaches the app and never reaches us.
The list of protected apps, files and folders, and any daily time limits you set for them.
The contents of the encrypted vault, which are encrypted on the device.
The activity log: unlock events, failed passcode attempts and settings changes, kept so that you can see what happened on your own device.
Intruder photos, if and only if you switch that feature on. The photo is taken by the front camera after repeated failed passcode attempts, saved into the app's protected storage on the device, and never uploaded.

Uninstalling Vaultis removes this data from your device, subject to how your operating system handles app storage and device backups you control.

Data we actually receive

Support correspondence. If you email us, we receive your email address, your message and anything you attach, such as a screenshot. We use it only to answer you.
Aggregate store reports. Apple and Google give every developer anonymous, aggregated statistics about installs, crashes and ratings. These reports do not identify you, and we cannot link them to a person or a device.

We do not collect contacts, location, browsing history, advertising identifiers, health data or the content of what you protect.

Why we process this data, and on what legal basis

To answer your support request. Legal basis: performance of a contract with you, and our legitimate interest in supporting our product (Article 6(1)(b) and 6(1)(f) of the GDPR).
To keep records of a request you made, for example a deletion request, so that we can prove we handled it. Legal basis: compliance with a legal obligation and our legitimate interest in defending against claims (Article 6(1)(c) and 6(1)(f)).
To operate features you switch on, such as intruder photos. Legal basis: your consent, given by enabling the feature and by granting the camera permission. You can withdraw it at any time by turning the feature off or by revoking the camera permission in your device settings.

Device permissions

Vaultis asks for a permission only when a feature needs it, and each one can be refused or revoked later in your device settings.

Camera: only for intruder photos. Off by default.
Biometrics: only to unlock the app and protected items faster.
Notifications: only to alert you about failed unlock attempts, if you enable that.
Usage access or accessibility service on Android: required by the operating system for an app locker to know which app has just come to the foreground. Vaultis uses it only to decide whether to show the passcode screen. It does not record what you do inside other apps and does not send anything anywhere.

Third parties

Vaultis contains no analytics software development kits, no advertising software development kits and no crash reporting software development kits. There is no Firebase, no Google Analytics, no Crashlytics, no Facebook software development kit and no similar component in the app.

Three third parties are unavoidably involved around the app:

Apple, which distributes the iOS app and gives us anonymous statistics. See the Apple Privacy Policy.
Google, which distributes the Android app in the same way. See the Google Privacy Policy.
Our email provider, which transports and stores support messages you send us.

Our legal website is served as static pages. It has no advertising, no tracking scripts and no analytics.

Storage, retention and international transfers

Everything Vaultis creates for you stays on your device for as long as you keep the app installed. You control it, and you can delete it inside the app at any time.

Support emails are kept for up to 12 months from the last message in the conversation, then deleted. Records showing that we completed a deletion request are kept for up to 12 months as proof of compliance.

Our email provider may process messages on servers outside your country, including outside the European Economic Area. Where personal data leaves the European Economic Area or the United Kingdom, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision. You can ask us for details about the safeguards in place.

Security

Vault contents are encrypted on the device with AES-256, using a key held in the operating system's secure storage, the iOS Keychain or the Android Keystore.
The passcode and recovery code are stored only as salted hashes produced with a slow derivation function, which makes guessing them expensive.
Repeated wrong passcodes trigger an escalating waiting period that survives closing and reopening the app.
Data in transit between you and us, for example on our website, is protected with HTTPS.
Access to support email is limited to the people who answer it, over accounts protected by strong passwords and two-factor authentication.

No security measure is perfect. If someone else has unlocked physical access to your device and knows your passcode, they can see what you protected. Please keep your device passcode strong and your operating system up to date.

Children

Vaultis is not directed to children. You must be at least 13 years old to use it, and older if the law where you live sets a higher age for using an online service without parental consent. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, write to privacy@vaultis.legalpage.site and we will delete it.

Your rights in the European Economic Area and the United Kingdom

You have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it erased, to receive it in a portable format, to restrict how we use it, and to object to processing that we base on our legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting what happened before.

In practice this concerns your support correspondence, because that is the only personal data we hold. Write to privacy@vaultis.legalpage.site and we will respond within 30 days, free of charge.

You may also complain to your national data protection authority. In the European Economic Area, you can complain to the authority in the country where you live or work.

Your rights in California

In the last 12 months we have collected one category of personal information from users: identifiers, meaning the email address and any details you include when you contact support. We collected it for customer support and kept it as described above.

We have not sold personal information and have not shared it for cross-context behavioural advertising. We do not have a "Do Not Sell or Share My Personal Information" mechanism because there is nothing to opt out of. We do not offer financial incentives in exchange for personal information, and we will never discriminate against you for exercising your rights.

You have the right to know, to delete, to correct and to limit the use of sensitive personal information. We do not collect sensitive personal information as that term is defined by the California Consumer Privacy Act. To make a request, write to privacy@vaultis.legalpage.site. An authorised agent may act for you with written proof of authorisation.

Deleting your data

There is no Vaultis account to delete, and the fastest deletion is in your hands: remove protected items in the app, then uninstall Vaultis. That removes the locally stored data from your device.

To have us delete support correspondence and any related records, use the form at https://vaultis.legalpage.site/delete-account or email privacy@vaultis.legalpage.site. We confirm completion within 30 days.

Cookies and similar technologies

The app does not use cookies. Our legal website does not use tracking or advertising cookies, and it does not profile visitors.

Changes to this policy

If we change this policy, we publish the new version at https://vaultis.legalpage.site/privacy and update the date shown there. If a change materially affects your rights, for example if we ever started collecting a new category of data, we will tell you inside the app before the change takes effect and, where the law requires it, ask for your consent.

Contact

Privacy questions and rights requests: privacy@vaultis.legalpage.site

Help with the app: support@vaultis.legalpage.site

This document was generated from an automated template and does not constitute legal advice. Have it reviewed by a qualified lawyer before publishing.

Back to Vaultis