Privacy Policy

Overview

Vaultaire is a local-first private photo vault. Your files are encrypted on your device under a random master key, which is wrapped by a key derived from your pattern. Wraxle does not operate a service that receives a readable copy of your vault contents, pattern, or decryption keys.

Data We Do Not Collect

• Your photos, videos, or files — all data is encrypted on-device and never leaves your phone unencrypted.
• Your pattern or encryption keys — pattern derivation and AES-GCM operations run locally. Lock paths discard active key state and key wrappers clear owned buffers on deallocation, but Vaultaire does not claim that Swift and iOS provably overwrite every transient memory copy.
• Your recovery phrase — stored with legacy pattern fields in an AES-GCM-encrypted recovery database in Keychain. A separate random Keychain item protects that database so the phrase can be shown later in vault settings.
• Vaultaire requires no account.

Feedback you choose to send

When you answer Yes or send feedback, Cloudflare D1 stores your response, message, optional reply email, language, app version/build, prompt opportunity, receipt time and a random submission ID. Written feedback is also emailed to the Vaultaire support team. We use it to answer you and improve the app. Drafts stay encrypted on your device until you send them. This is separate from PostHog analytics, which is on by default and can be turned off; feedback is not sent to PostHog.

App analytics (enabled by default)

App analytics and crash diagnostics are enabled by default. You can turn them off in Settings with “Share errors anonymously”. When this setting is off, PostHog does not start and the app does not save analytics events to send later.

• PostHog receives coarse product events, performance data, and handled errors. Vault contents, patterns, recovery phrases, structured filenames and file types, share IDs, vault IDs, raw StoreKit product IDs, transaction IDs, and receipts are excluded. Vault open events carry a pseudonymous per-vault token derived from a key fingerprint, which cannot be reversed to a vault, a pattern, or its contents, but stays stable for that vault. Crash reports can include file names. PostHog's privacy policy.
• Apple Ads attribution When “Share errors anonymously” is on, Apple AdServices checks whether an install came from an Apple ad. Vaultaire sends the attribution token to Apple through our service. We do not retain the raw token or the random install UUID. PostHog receives a hashed identifier and general attribution data. StoreKit receives the same random UUID as an app account token for purchases.

Turning this setting off disables product analytics, crash reports, Apple Ads attribution, and the StoreKit key used only for analytics. Vaultaire does not use IDFA, ask for tracking permission, or send ad conversion events when the app opens.

Website analytics

The Vaultaire website (vaultaire.app) uses PostHog for first-party website analytics. PostHog stores an anonymous random identifier in your browser's localStorage so we can count unique visitors and measure session lengths without using cookies or cross-site tracking. Website and in-app analytics use separate identifiers.

To attribute visits from ChatGPT ads, the website also uses the OpenAI Ads Measurement Pixel. It can store a privacy-preserving ad-click reference in the first-party __oppref cookie and sends an app_store_clicked event when you select a Vaultaire App Store link. We do not send names, email addresses, account IDs, or app content. The event opts out of future user-level personalization, and the pixel does not load when your browser sends Global Privacy Control.

iCloud Backup

iCloud Backup is on by default and can be turned off in Settings. While it is on, Vaultaire derives a separate device-independent backup key from your pattern and uploads padded AES-GCM-encrypted records to your private CloudKit database. Phrase-based restore also stores an encrypted recovery manifest. Wraxle does not receive your iCloud credentials or readable vault contents. Apple’s iCloud terms apply to this storage.

Vault Sharing

When you share a vault, the app encrypts it on your device and uploads it as encrypted chunks to Apple's CloudKit public database. The recipient opens it by entering the share phrase you give them. The phrase never reaches our servers. The share record name is derived from the phrase, so someone who collects public share records can test phrase guesses offline, and shares made from the same iCloud account can be linked to each other. Expiry, open limits and export blocking are enforced by the recipient's app.

In-App Purchases

Vaultaire offers a premium subscription through Apple's App Store. All purchase transactions are handled by Apple. We do not collect or store your payment information. Apple's terms and privacy policy govern these transactions.

Third-Party Services

• Apple CloudKit — used for vault sharing and iCloud backup (encrypted data only)
• Apple StoreKit — used for in-app purchase processing
• Apple AdServices — Used for Apple Ads install attribution while “Share errors anonymously” is on
• PostHog — coarse in-app product analytics and crash diagnostics, plus separate first-party website analytics
• OpenAI Ads Measurement Pixel and Conversions API: website-only ChatGPT ad attribution using the first-party __oppref cookie and an App Store link-click event

Children's Privacy

Vaultaire does not knowingly collect personal information from children under 13. The app requires no account. Analytics can be disabled in Settings and are not intended for use by children under 13.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated revision date.