VaultKit Privacy Policy

Last updated: 6 November 2026

Overview

VaultKit is an encrypted vault for photos, videos, documents and notes on your iPhone. Each vault opens with a pattern you draw, and every pattern opens its own separate vault. Everything you put in a vault is encrypted on your device with keys that never leave it. This policy explains exactly what data VaultKit handles, how, why, and which third parties are involved.

The short version: VaultKit has no accounts and no servers of its own. We never receive your files, your patterns, your recovery phrases or your encryption keys, and we could not open your vaults even if we were asked to.

What data the app handles, and how

VaultKit has no user accounts. We never ask for and never receive your name, email address, phone number, contacts, location, or advertising identifier. The app handles only the following, all of it on your device:

• Vault contents. The photos, videos, documents and notes you add, together with their thumbnails, file names, folder names and vault names. Collected when you take a photo or video in the app, pick items from your photo library or the Files app, or write a note. Everything is encrypted with XChaCha20-Poly1305 the moment it is added, before it is written to storage.
• Patterns and recovery phrases. These are never stored. VaultKit derives encryption keys from them and keeps those keys in memory only while a vault is open. A random salt used for recovery phrases is kept next to the vault files.
• A device secret. A random key created on first use and kept in the iOS Keychain. It is mixed into every vault key, so vault files cannot be opened by guessing patterns on another device. It is not synced through iCloud Keychain.
• Temporary decrypted copies. To play a video, preview a document or hand an item to another app, VaultKit decrypts a temporary copy. These copies are deleted when the vault locks. Plaintext copies made by the system pickers during an import are deleted as soon as the item is encrypted.
• App preferences and counters. Theme, language, import quality, whether the pattern is shown while drawing, whether you have seen the introduction and the welcome offer, whether VaultKit Pro is active, how many imports you have made and when the app last asked for a rating. These are stored unencrypted in the app’s own storage and contain nothing from your vaults.

The camera, microphone and photo library are only used after you grant the matching iOS permission, and only for the actions described below. VaultKit never uses the camera or microphone in the background.

How this data is used

• To store your files in encrypted vaults and show them back to you when you open a vault.
• To open the vault that matches the pattern you draw, and to restore access with a recovery phrase.
• To remove the originals from your photo library after an import, only when you choose to. Removed originals go to Recently Deleted in Photos, where iOS keeps them for 30 days.
• To save items you export to your photo library, or hand them to the app you choose.
• To apply the free plan’s limits and unlock VaultKit Pro.
• To remember your settings between launches.

We do not sell your data, do not share it with advertisers or data brokers, do not use it for advertising or tracking across apps or websites, and do not build a profile about you. VaultKit contains no third-party advertising, analytics or tracking SDKs.

Third parties

VaultKit sends nothing to us and uses no third-party services of its own. The only other parties involved are Apple, through features of iOS and the App Store, and any app you choose to share an item with.

Apple Inc. — purchases and ratings

Receives: your subscription and purchase activity, handled entirely by the App Store, and any rating or review you choose to leave.
Purpose: processing VaultKit Pro purchases and telling the app whether Pro is active. VaultKit never receives your name, email or payment details.
Apple Privacy Policy

Apple Inc. — device backups

Receives: if you use iCloud Backup or an encrypted computer backup, iOS includes VaultKit’s encrypted vault files and the device secret in that backup.
Purpose: letting your vaults work on a restored iPhone. The files stay encrypted inside the backup and still need your pattern or recovery phrase. Backups are made by iOS, not by VaultKit, and you control them in iOS Settings.

Apps you share with

Receive: the decrypted copy of an item when you save it to Photos, share it, or use “Open in…”.
Purpose: whatever you chose to do with it. From then on that copy is covered by the privacy policy of the app or service you chose.

Retention and deletion

• On your device: vault contents are kept until you delete them, delete their vault, or use Erase everything in App settings, which destroys every vault and the device secret.
• Duress vault: if you set one up, drawing its pattern erases every other vault on the device, including their recovery phrases. Erased vaults cannot be recovered.
• Deleting the app removes the vault files from your iPhone. iOS may keep the device secret in the Keychain after the app is deleted; use Erase everything first if you want it gone too.
• Copies inside existing device backups remain until you delete those backups.
• On our side: nothing. We hold no copy of your vaults, settings or purchase records.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to withdraw consent. Because VaultKit keeps everything on your device and we hold no account or copy of your data, you exercise these rights yourself in the app: export items, delete them, or erase everything. For any question, write to archimidias@gmail.com and we will respond within 30 days. We do not sell or share personal information as those terms are defined under US state privacy laws.

Diagnostics

VaultKit does not send crash reports or usage analytics. If you have allowed iOS to “Share With App Developers” in your iPhone’s Analytics settings, Apple may share anonymous crash data with us; you control this in iOS Settings. If we ever add crash reporting to the app, it will be off unless you turn it on, it will never include vault contents, patterns, recovery phrases, file names or file types, and we will update this policy first.

Children’s privacy

VaultKit is a general-audience app and is not directed at children under 13. We do not knowingly collect personal information from anyone, including children, and we receive nothing a child stores in the app.

International transfers

VaultKit does not transfer your data anywhere. Purchases, ratings and device backups are handled by Apple, which may process that data in other countries under its own privacy policy.

Changes

We may update this policy to reflect changes in the app or in legal requirements. When we do, we will update the “Last updated” date above, and before any change that sends data off your device (for example, VaultKit’s own iCloud backup or sync) we will update this policy and tell you inside the app.

Contact

Questions about this policy or about your data: archimidias@gmail.com