[operator legal name] and [jurisdiction] — and has counsel review the governing-law and liability wording. If Kistvault ever adds analytics, a backend, sync or purchases, this policy and the app-store disclosures must be updated first.The short version
Kistvault is an encrypted file vault that runs entirely on your device. We — the developer — operate no server for Kistvault. We do not collect, receive, store, see, or share your files or any personal information. Your photos, videos and documents, and the password or pattern that protects them, never leave your device through Kistvault, and we have no way to access them.
Who we are
Kistvault ("the app") is provided by [operator legal name] ("we", "us"). You can reach us at hello@kistvault.app.
What data we collect
None. Kistvault has no account system and no backend of its own. Specifically:
- We do not collect your name, email address, phone number, or any contact details.
- We do not collect or receive your files, photos, videos, documents, or their contents, names, or metadata.
- We do not collect your password, pattern, PIN, biometric data, or any encryption keys.
- We do not use analytics, crash-reporting services, advertising, or tracking of any kind.
- We do not use cookies or any web-based tracking (the app is not a website).
- We do not collect device identifiers or an advertising ID.
Because we collect nothing, there is nothing for us to sell, share, or disclose.
How your data is handled on your device
Everything happens locally:
- Your files are encrypted on your device using standard, published cryptography (AES-256-GCM for content; Argon2id to derive a key from your password or pattern; HKDF-SHA256 for key derivation).
- Your password or pattern is used only on your device to derive the key that unlocks your vault. It is never transmitted and is not stored in a form we or anyone else can use to open your vault.
- There is no operator key. If you lose every way to unlock your vault (your password/pattern and your Recovery Kit), no one — including us — can recover it. This is a deliberate property of the design, not a limitation we can override.
Device permissions
Kistvault asks for the minimum necessary, and only when you use a feature that needs it:
- Photos (import): On iPhone, Kistvault uses the system photo picker, which does not give the app access to your library — you choose individual items. Kistvault requests broader Photos access only if you turn on an option to delete originals after importing. On Android, Kistvault uses the system Photo Picker and does not request broad media permissions.
- Camera (if you scan or capture a document): used only to capture images you add to your vault. Captured images are encrypted immediately and are not saved to your camera roll or any shared location.
- Biometrics (Face ID / Touch ID / fingerprint): used as a convenience to unlock your vault. Your password or pattern always works as an alternative. Biometric data is handled by your device's operating system; Kistvault never sees it.
Kistvault does not request location, contacts, microphone, SMS, or (on Android) internet access.
Backups and exports you create
Kistvault lets you create a Recovery Kit (a printable document) and an encrypted export of your vault (an opaque, encrypted file). These are produced on your device and are yours. Kistvault never uploads them anywhere. If you choose to store, print, copy, or move them, you are responsible for keeping them safe — anyone who obtains your Recovery Kit, or your export together with your password/pattern, may be able to open your vault.
Children's privacy
Kistvault is a general-purpose utility and is not directed at children. We do not knowingly collect any information from anyone, including children, because we collect no information at all.
Data sharing and third parties
We do not share any data with third parties, because we do not collect or receive any. Kistvault integrates no third-party analytics, advertising, or tracking services.
The app stores themselves (Apple App Store, Google Play) may collect information about your download and use of the app under their own privacy policies, which we do not control. See Apple's and Google's privacy policies for details.
About this website
This policy covers the Kistvault app. This marketing website (kistvault.app) uses a privacy-friendly, cookieless analytics tool to count visits and see which pages are useful. It sets no cookies, collects no personal information, does not track you across sites, and does not build a profile of you — so there is no consent banner to click. It is entirely separate from the app, which, as described above, collects nothing at all.
Security
Your content is protected by on-device encryption as described above. No security measure is perfect: the strength of your vault depends on the strength of the password or pattern you choose, and on keeping your Recovery Kit and any exports safe. We state plainly, in the app and here, what each protection does and does not cover — for example, on iPhone the operating system provides no way to block screenshots, so Kistvault detects them rather than preventing them, and no app can guarantee data is securely erased from flash storage.
Your rights
Because we hold none of your data, there is no personal data for us to access, correct, export, or delete on your behalf. You are always in full control of your data on your device: you can delete individual items, delete a vault, or uninstall the app, which removes the app's data from your device.
International use and export controls
Kistvault contains encryption and is distributed internationally through the app stores in compliance with applicable export-control laws. The app functions the same wherever it is installed and still sends no data off your device.
Changes to this policy
If we change this policy — for example, if a future version of Kistvault adds a feature that handles data differently — we will update this page and the "Last updated" date, and, where required, reflect the change in the app stores' privacy disclosures before the change takes effect.
Contact
Questions about this policy or your privacy: hello@kistvault.app.
This policy describes Kistvault as of the date above. It is written to match the app's actual behaviour: a local-only, zero-knowledge vault that collects nothing. It is a plain-language summary, not legal advice.