Privacy Policy

Effective date: 9 November 2026

Who we are

VaultAll is an iPhone app made by Rohith Krishna, an individual developer based in the United Kingdom. In this policy, “we” and “us” mean Rohith Krishna. You can contact us at support@vaultall.app.

The short version

What stays on your iPhone and how it’s protected

• Your photos, videos, documents and notes are encrypted on your iPhone (AES-256-GCM) with keys that only your PIN can unlock. Their names, dates and folder names are encrypted too.
• Your PIN is never stored and never uploaded. It is turned into a key with Argon2id, which makes guessing slow.
• Vault items are not in the Photos library. The vault’s files are left out of your iPhone’s own iCloud or computer backups; VaultAll’s own encrypted backup (below) is the only backup.
• Text search reads the words inside your photos, scans and PDFs using Apple’s text recognition on the iPhone itself. Those words are kept encrypted inside the vault and are never backed up, shared or sent anywhere.
• Break-in alerts, if you turn them on, take a front-camera photo after 3 wrong PINs. The photo is encrypted, stays on this iPhone and is never uploaded.
• Text you copy inside a vault stays in VaultAll’s own clipboard, in memory only, and is cleared when the vault locks.
• One exception: to preview a Word, Excel, PowerPoint, Pages, Numbers or Keynote document, iOS needs a temporary file. It is protected by iOS while the phone is locked and is deleted when the preview closes, when the vault locks and when the app starts.
• When you choose to export or save a readable copy of something, that copy is no longer protected by VaultAll. The app asks you to confirm and never exports on its own.

Backups to your own iCloud, Google Drive, Dropbox or OneDrive

• Backup is on by default and goes to your own iCloud. In each vault’s Settings you can choose Google Drive, Dropbox or OneDrive instead.
• Everything is encrypted on your iPhone before it is uploaded, and the files have random names. Only that vault’s 12 recovery words can open the backup. We can’t read it, and neither can Apple, Google, Dropbox or Microsoft.
• The service that holds your backup can see that VaultAll stores files there, how many there are, roughly how big they are and when they change. It can’t see what is in them or how many vaults you have.
• For Google Drive, Dropbox and OneDrive, you sign in on that company’s own sign-in page. VaultAll asks for access to its own folder only, not the rest of your files, and does not ask for your name or email address. (Dropbox includes your name and email address with the free-space figure the app reads; VaultAll does not store or send them.) Sign-in tokens are kept in this iPhone’s Keychain and never leave it.
• The backup lives in your account, so that company’s own privacy policy applies to it: Apple, Google, Dropbox, Microsoft.

Sharing by link (end-to-end encrypted)

• You can share one vault, view only, with up to 10 people. Each person gets a link and an 8-character code, which you send separately. By default, their phone then shows a 12-character reply code that they read to you and you type in, so nobody gets in without your approval.
• A shared vault is encrypted with keys that only you and the people you let in hold. The link holds no key. Its encrypted files stay in your own cloud account, and the people you invite download them through read-only links. Nothing goes through us.
• The service that holds it can see that a folder is shared by link, its size, and roughly when and from which IP addresses it is downloaded. On iCloud, Apple can also see which Apple Accounts opened the link.
• Items a person opens are kept in an encrypted cache on their phone. They can save readable copies only if you turn on “Allow saving”, which is off by default. Anyone can still photograph their screen.

Purchases

Purchases are made through Apple’s App Store, and Apple handles payment. We don’t receive your name or payment details. The app asks Apple, on your iPhone, only whether you have Pro. Apple’s privacy policy applies to your purchases.

Crash reports and diagnostics

VaultAll contains no crash-reporting, analytics or advertising code. If you have chosen to share analytics with app developers in your iPhone’s settings (Settings > Privacy & Security > Analytics & Improvements > Share With App Developers), Apple may share crash reports and diagnostic data with us. Apple decides what is included, and you can turn this off at any time in the same place.

Permissions the app asks for, and why

VaultAll asks for each permission only when you use the feature that needs it. You can change any of them in your iPhone’s Settings.

• Camera: to scan documents, to take photos and videos straight into your vault, and, with Break-in Alerts on, to take a front-camera photo when someone enters a wrong PIN 3 times.
• Microphone: to record sound with videos you take in VaultAll’s private camera. The sound is encrypted with the video.
• Photos (full access): only to finish an import that stopped when the app was closed, or to delete originals you have imported, when you choose to.
• Photos (add only): only when you choose Save to Photos in a shared vault whose owner allows saving.
• Face ID or Touch ID: to open the one vault you choose instead of typing its PIN. It is optional.
• Google, Dropbox or Microsoft sign-in: only if you choose one of them for backup or sharing, as described above.

Quick Lock (lock when the phone is face down, or on a shake) uses the motion sensor only while a vault is open. It needs no permission and stores or sends nothing. VaultAll does not use your location, contacts or notifications.

This website

vaultall.app has no cookies, no analytics, no trackers and no outside fonts or scripts. It is hosted by Vercel, whose servers process your IP address to deliver the pages and may keep short-lived logs. The domain’s DNS is run by Cloudflare, which does not see your visits.

If you email us

When you email support@vaultall.app, we receive your email address and whatever you write. The message is forwarded by Cloudflare’s email routing to our Gmail inbox, which Google provides, so it may be processed outside the UK. We use it only to reply to you, our legal basis being our legitimate interest in answering your question. We don’t share it or use it for marketing, and we delete it when it is no longer needed to help you. Please don’t send us your PIN or recovery words: we never need them.

Children

VaultAll doesn’t collect personal data from anyone, including children.

Your rights under UK GDPR

Under UK data protection law you have the right to ask for a copy of the personal data we hold about you, and to have it corrected or deleted. You can also object to or restrict how we use it, and ask for it in a portable format. The app sends us nothing, so in practice the only personal data we may hold is an email you sent us. To use any of these rights, email support@vaultall.app.

Everything in your vault is under your control: deleting the app removes it from your iPhone, and you can delete VaultAll’s backup through your cloud service’s storage settings. If you think we have handled your data badly, you can complain to the UK Information Commissioner’s Office at ico.org.uk.

Changes to this policy

If this policy changes, we’ll update this page and the effective date. Important changes will also be mentioned in the app’s update notes.

Contact

Questions about privacy: support@vaultall.app.