VaultCaveLast updated: 2026-11-02
VaultCave is built so that we don't have your data in the first place. This policy explains what that means in practice: what stays on your iPhone, what (if anything) leaves it, and the few cases where Apple or another party is involved.
In short: VaultCave has no account, no analytics, no ads and no trackers. Your photos, videos, files, file names, patterns, passcodes and recovery phrases are encrypted on your device and never sent to us. Our App Store privacy label is "Data Not Collected".
Who we are
VaultCave (the "app") is provided by Pedro Lopes, Portugal ("we", "us"). For anything about privacy, write to privacy@vaultcave.app.
What the app does with your content
Everything you put in a vault (photos, videos, documents, any file, their names, dates and folders, and the vault's settings) is encrypted on your iPhone with AES-256 before it is stored. The keys come from your pattern or passcode together with a secret held by your iPhone's secure hardware. We never receive your content, your keys, your pattern, your passcode or your recovery phrase, and we have no way to decrypt your vaults.
Because we hold nothing, we can't recover a vault for you, reset your pattern, or hand your content to anyone.
Data we collect
None. The app contains no analytics, crash reporting, advertising or tracking SDKs, and it does not send us usage data, device identifiers or diagnostics. We do not sell, rent or share personal data, because we don't collect it.
If we ever add optional crash reports, they will be off by default, will never include file names or content, and this policy and the App Store label will be updated before that ships.
When something leaves your iPhone
Only in these cases, each one started by you:
Encrypted iCloud backup (optional)
If you turn on backup, the app uploads your vaults to your own iCloud account using Apple's CloudKit private database. Everything is encrypted on your iPhone before upload, record names are random, and file sizes are padded so they don't reveal what's inside. Apple stores data it can't read, and we have no access to your iCloud account at all. Restoring requires the vault's 12-word recovery phrase.
Apple's handling of iCloud is covered by Apple's Privacy Policy. Someone with access to your Apple ID could delete your backup, but could not read it. You can turn backup off in the app's Settings at any time; doing so deletes the vault's backup from iCloud.
Encrypted sharing (optional, Pro)
When you share items, the app creates an encrypted file and a separate share phrase. You choose how to send them (for example by message or email). That file passes through whatever app or service you choose, under its own privacy terms; without the phrase it can't be opened. We are not involved and don't receive it.
Exports
If you export a file, a readable copy leaves the vault and goes wherever you send it. The app warns you before every export.
Purchases
Subscriptions and the lifetime purchase are handled entirely by Apple through the App Store. We don't receive your payment details or your Apple ID. The app only learns from Apple whether Pro is active on your account. See Apple's Privacy Policy.
Permissions the app asks for
- Photos: only when you choose to delete the originals of photos you've imported, after their encrypted copies are verified. Importing itself uses Apple's photo picker, which shares only the items you pick.
- Camera and microphone: only when you take a photo or video inside the app; captures go straight into your vault, never your camera roll.
You can change these in iOS Settings at any time.
Children
The app is not directed at children under 13 (or the minimum age in your country), and we knowingly collect no data from anyone, of any age.
Your rights
Under the GDPR and similar laws you have rights to access, correct, delete and port personal data, and to object to or restrict its processing. Since we hold no personal data from the app, there is nothing for us to access or delete on our side; your data lives on your device and, if you enabled it, in your own iCloud account, where you control it:
- Delete a vault: Settings → Delete vault (you can choose to delete its iCloud backup too).
- Delete everything: delete the app, and turn off or delete the backup first if you want it gone from iCloud.
If you write to us, we use your email only to answer you and delete the conversation when it's resolved, unless the law requires otherwise. You can also complain to your data protection authority.
This website
https://vaultcave.app is a static website hosted by Vercel. It uses no cookies, no analytics and no trackers. Like any web host, Vercel processes technical data such as IP addresses in server logs to deliver and secure the site; see Vercel's Privacy Policy. Photos on guides and articles are loaded from Unsplash's image servers, which receive your IP address and browser details when they deliver an image; see Unsplash's Privacy Policy. The app itself never contacts Unsplash.
Changes
If this policy changes, we'll update the date above and, for meaningful changes, mention it in the app's release notes.