Privacy Policy

Overview

Vaultaire is a private photo vault app designed with zero-knowledge architecture. Your files are encrypted on your device using a key derived from your pattern. We cannot access, view, or recover your data.

Data We Do Not Collect

• Your photos, videos, or files — all data is encrypted on-device and never leaves your phone unencrypted.
• Your pattern or encryption keys — these are derived locally and wiped from memory when you lock the app.
• Your recovery phrase — stored only in your device's Secure Enclave.
• Your name, email, or account information — Vaultaire requires no account to use.

App analytics (off by default)

Vaultaire does not ask for analytics permission during onboarding. In-app analytics and crash diagnostics remain off unless you turn on Help improve Vaultaire in Settings. Before that opt-in, the app does not start PostHog or queue analytics events for later delivery.

• PostHog receives coarse product events, performance data, and handled errors. Vault contents, patterns, recovery phrases, structured filenames and file types, share IDs, vault IDs, raw StoreKit product IDs, transaction IDs, and receipts are excluded. PostHog's privacy policy.

Turning the setting off disables product analytics and crash reporting. The iOS app does not perform advertising attribution, create advertising identifiers, or send app-open advertising conversion events.

Website analytics

The Vaultaire website (vaultaire.app) uses PostHog for first-party website analytics. PostHog stores an anonymous random identifier in your browser's localStorage so we can count unique visitors and measure session lengths without using cookies or cross-site tracking. Website and in-app analytics use separate identifiers.

To attribute visits from ChatGPT ads, the website also uses the OpenAI Ads Measurement Pixel. It can store a privacy-preserving ad-click reference in the first-party __oppref cookie and sends an app_store_clicked event when you select a Vaultaire App Store link. We do not send names, email addresses, account IDs, or app content. The event opts out of future user-level personalization, and the pixel does not load when your browser sends Global Privacy Control.

iCloud Backup

If you enable iCloud Backup in settings, your encrypted vault data is uploaded to your personal iCloud account. The data remains encrypted with your pattern-derived key. We do not have access to your iCloud account or the uploaded data. Apple's iCloud terms apply to this storage.

Vault Sharing

When you share a vault via link, the encrypted data is transmitted through Apple's CloudKit infrastructure. The share link contains the decryption phrase in the URL fragment (after the #), which never reaches our servers. Only the intended recipient with the full link can decrypt the shared vault.

In-App Purchases

Vaultaire offers a premium subscription through Apple's App Store. All purchase transactions are handled by Apple. We do not collect or store your payment information. Apple's terms and privacy policy govern these transactions.

Third-Party Services

• Apple CloudKit — used for vault sharing and iCloud backup (encrypted data only)
• Apple StoreKit — used for in-app purchase processing
• PostHog — coarse in-app product analytics and crash diagnostics, plus separate first-party website analytics
• OpenAI Ads Measurement Pixel and Conversions API: website-only ChatGPT ad attribution using the first-party __oppref cookie and an App Store link-click event

Children's Privacy

Vaultaire does not knowingly collect any personal information from children under 13. The app does not require an account or collect any personal data.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated revision date.