Privacy Policy

Last updated: 3 August 2026
This privacy policy applies both to the use of the iOS app Vaultora and to the website vaultora.app.

Note: This is a translation for convenience. In case of doubt, the German version is the authoritative text, as the provider is based in Germany and German law applies.

1. Controller

Tobias Zehndbauer
Kapellenweg 11
85132 Schernfeld/Sappenfeld
Germany
Phone: +49 9145 839641
Email: info@vaultora.app

2. Data collection in the Vaultora app

2.1 No collection of personal data by us

Vaultora is an encrypted vault for recordings and files on your iPhone. The app collects, stores and transmits no personal data whatsoever to us or to third parties. There is no tracking, no analytics, no telemetry and no advertising. There is no user account and no registration. We operate no server the app could talk to.

2.2 Data stored locally

The following data is stored exclusively on your device:

• Vault contents — the photos, videos, audio recordings and documents you record or add, stored encrypted in the app's protected area.
• Vault metadata such as a name of your choosing and sort order.
• Key material derived from your secret. The secret itself is not stored in the clear.
• App configuration such as language setting and display options.

This data does not leave the device. It is transmitted neither to us nor to third parties.

2.3 Network connections made by the app

Vaultora establishes no network connections of its own accord. There are no connections to servers operated by us or by third parties. The only network feature is the local server you switch on yourself (see 2.7).

2.4 Apple App Store and in-app purchase

When you download the app from the Apple App Store and when you make the one-time in-app purchase, Apple Inc. collects its own data and handles the payment. That processing is subject to Apple's privacy policy and is outside our control. We do not learn who downloaded or bought the app; Apple provides us only with aggregated sales figures without any personal reference.

2.5 No iCloud sync, exclusion from the iCloud backup

Vaultora does not synchronise — neither via iCloud nor via any other service. There is no sync setting that could be switched on.

Beyond that, the directory holding the vaults is explicitly excluded from the iCloud backup. Vault contents therefore do not enter a device backup and do not reach Apple's servers. The flip side: if a device is restored from an iCloud backup, no vaults will be present.

The only way to back up vault data or move it to another device is an encrypted archive that you create manually (see 2.6). A forgotten secret means the data is permanently lost — there is no master key and no recovery by us.

2.6 Encrypted archive (export)

You can create an encrypted archive of your vault data and store it, via the iOS Files app, in a location of your choosing (e.g. locally on the device, in iCloud Drive, with another provider, or on an attached drive). Where you put it is entirely your decision; from that point the terms of the respective storage location apply. Vaultora does not transmit the archive to us or to third parties. The archive cannot be read without the matching secret; the secret is not stored with it.

2.7 Local HTTPS server on your own network

At your request, Vaultora can start a local server so that you can exchange files with a computer on the same network. That is a transfer — not to us and not to the internet, but it should be named:

• The server runs only while you have switched it on and the app is in the foreground.
• It is reachable on the local network only and protected by a one-time password generated afresh on every start.
• The connection is encrypted; the certificate is self-signed and generated per session.
• There is no port forwarding and no connection to the outside. No server of ours is involved.

Only the files you transfer yourself are transferred. We have no access to them and learn nothing about them. You are responsible for the security of the network on which you run the server.

2.8 Camera, microphone, photo library, share extension

• Camera and microphone are used only while you are making a recording, and only with the relevant system permission. Recordings are stored encrypted in the vault immediately.
• The app can read images and videos from the photo library when you select them. Vaultora never writes to the photo library.
• A share extension receives files you hand to Vaultora from other apps. The extension passes the file on to the app and transmits it nowhere else.

On your legal responsibility when recording other people, see the Terms of Use.

2.9 Face ID and Touch ID

If you enable unlocking via Face ID or Touch ID, the operating system checks the biometric data. It never leaves the device's Secure Enclave. Vaultora receives neither the data nor a copy of it, only the system's answer as to whether the check succeeded.

3. Data collection on this website

3.1 Hosting with Cloudflare

This website is served via Cloudflare Workers operated by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When the website is accessed, Cloudflare processes technically necessary connection data (in particular IP address, date and time, URL requested, browser type, operating system) in order to deliver the content and to defend against attacks.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable, secure and fast operation of the website). A data processing agreement is in place with Cloudflare. Cloudflare uses EU standard contractual clauses, as personal data may be transferred to the USA. Further information: Cloudflare privacy policy.

3.2 No cookies, no tracking, no external resources

This website sets no cookies, uses no tracking and no analytics tools (no Google Analytics, no Matomo or similar) and embeds no external fonts, images or scripts. There is no JavaScript on this website at all. All style declarations and images are served from the same address. Rendering uses the system fonts already present on your device.

There are no contact forms. Contact is by email.

3.3 Language selection

If you open the start page without specifying a language, the server evaluates your browser's Accept-Language header once and redirects you to the German or the English version. Your browser sends this header with every request anyway; it is not stored, not analysed and not passed on to third parties.

We deliberately do not use IP-based geolocation for this. Accept-Language says which language someone wants to read. IP geolocation says where someone currently is — that is a different question, it is wrong more often, and it processes more than this question requires.

Both language versions are directly reachable at their own addresses (/de/ and /en/) and can be switched at any time using the switcher in the page header. Anyone opening a language address directly gets that language, regardless of the header. No cookie is set for this and nothing is stored.

3.4 Contact by email

If you contact us by email, we process your email address and the content of your message solely in order to handle your enquiry. The legal basis is Art. 6(1)(b) or (f) GDPR. The data is deleted once the enquiry has been dealt with conclusively and no statutory retention obligations prevent deletion.

4. Your rights under the GDPR

You have the right at any time to:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure ("right to be forgotten", Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Since we process no personal data of yours in the app itself, we can neither provide information about vault contents nor delete them — we simply have no access. You delete vaults and archives yourself on your device.

To exercise these rights, contact: info@vaultora.app

5. Changes to this privacy policy

We reserve the right to adapt this privacy policy in the event of changes to the app, the website or the legal situation. The current version is always available on this page.