Privacy policy: Plain Vault (working name): Private Photo Vault

Status: this app is in development and has not been released yet. This policy describes what the app is designed to do, as written in its specification; it will be reviewed again before release.

In short

The app keeps private photos and videos in an encrypted vault on your phone. It has no account, no advertising, no analytics and no crash reporter, and it contains no network code. Nothing leaves the phone. Your photos are encrypted on the phone, and only your PIN (or passphrase) or your recovery key can open them: not us, not anyone. If you forget your PIN and lose your recovery key, the photos cannot be recovered. There is no reset and no account. Deleting the app deletes the vault.

What is stored on your phone

• Your photos and videos, as encrypted files inside the app, together with thumbnails and metadata, also encrypted. Files are named with random ids.
• A catalog database listing your items and albums, which is encrypted.
• A plain settings database with non-sensitive values such as language, theme, lock timeout, whether biometrics and screenshot blocking are on, and counts about your last backup. These counts reveal that a vault exists, but not what is in it.
• Videos and exports create a temporary decrypted copy in the app's private folder while in use; the About page says when it is cleared.
• Keys are protected by your PIN or passphrase and, where the phone has it, secure hardware. Settings show how the key is protected on your phone.
• The vault folder is excluded from iPhone device backups by default, and from Android cloud backup. A switch lets you include it in the iPhone backup.

Permissions

• Face ID or fingerprint for unlocking, if you use biometrics.
• Photo library: on iPhone, asked only when you choose "Delete originals" or "Save to Photos" (add-only). Picking photos to import uses the system picker.
• No camera, microphone, location or contacts. Android release builds request only the biometric permission and have no internet permission.

Backup and export

The backup is a folder you choose, for example in iCloud Drive, Google Drive, local storage or on a USB drive. It holds the already-encrypted files, so nothing readable leaves the phone, and the provider you chose there sees only encrypted data, its size and the number of files. You can test a backup against your recovery key. You can also share a photo or video out of the vault yourself. You decide where files go.

What the app does not do

No advertising, no analytics, no crash reporting, no accounts, no network use. Planned store privacy labels: App Store "Data Not Collected"; Google Play collects nothing and shares nothing.

Contact

Questions about privacy: plainapps@tuta.com.