Privacy Policy

1. Controller

Johanna Hoppe
Baccumer Str. 19
49808 Lingen
Germany

Email: purevault-support@whitoutcookies.dedyn.io

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Your vault content stays on your device

Photos, videos, PDFs, titles, notes, album names, tags and other vault data are encrypted and stored locally in the app’s container on your iPhone. Encryption keys and passcode material are kept in the device Keychain. This content is not sent to us, to RevenueCat or to any other server. It only leaves the app when you explicitly export or share it, or create an encrypted transfer file, and then only to the destination you choose.

3. Permissions on your iPhone

The app only asks for a permission when you use the matching feature. You can change every permission in iOS Settings at any time.

• Photos: imports use Apple’s photo picker, which gives the app only the items you select. If you choose to delete an original from Apple Photos as well, the app asks for access to your photo library for that action.
• Camera and microphone: only used when you take a photo or record a video directly into the vault.
• Face ID / Touch ID: optional. Biometric data is handled entirely by iOS; the app only receives whether authentication succeeded.
• Notifications: optional. If you allow them, the app schedules local reminders on your device. The timing is based on import times stored locally; nothing is sent to a server.

4. Local diagnostics

To help verify imports and purchases, the app keeps up to 200 technical events on your device. They contain no media, file names, paths or passcodes and are never uploaded automatically. If you copy the support diagnostics and send them to us, they include your app version, purchase status and RevenueCat app user ID.

5. In-app purchases (Apple and RevenueCat)

Apple processes payments, App Store purchases and your Apple Account as an independent controller under Apple’s own privacy policy. We do not receive your payment details.

RevenueCat (RevenueCat, Inc., USA) is our processor for purchase management. To check and restore the one-time purchase, the app transmits to RevenueCat: an anonymous app user ID generated by the app, App Store purchase and transaction information (such as product, purchase date and receipt data), app and system information (such as app version, iOS version, device type, language and App Store country) and, for technical reasons, your IP address. RevenueCat does not receive vault content, passcodes or encryption keys.

Purposes and legal bases: validating and restoring your purchase (Art. 6(1)(b) GDPR, performance of a contract); preventing fraud and evaluating purchases in aggregated form (Art. 6(1)(f) GDPR; our legitimate interest is a reliable, secure purchase process and understanding how the app is used commercially). The app does not use RevenueCat or any other service for advertising or cross-app tracking.

Retention: RevenueCat keeps purchase data as long as it is needed to provide and restore the purchase and as required by law, and deletes it when we ask it to.

6. No advertising or tracking

The app contains no advertising SDKs, no general-purpose analytics SDKs and no cross-app tracking. You do not need an account to use PureVault.

7. This website

Hosting and server logs: this website is hosted by Netlify, Inc. (USA) as our processor. When you visit it, technically required connection data is processed, such as IP address, date and time, requested page, HTTP status, referrer and browser information, to deliver the website and keep it secure (Art. 6(1)(f) GDPR). Server logs are kept only briefly and deleted regularly.

No cookies or analytics: this website sets no tracking or marketing cookies and uses no analytics tools such as Google Analytics or Meta Pixel.

Local resources: fonts, the app icon and screenshots are served from this domain. The website does not load Google Fonts, App Store media or third-party scripts. Links to the App Store only connect you to Apple when you click them.

8. Contacting us by email

If you email us, we process your email address, your message and any information you include (for example support diagnostics) to answer your request (Art. 6(1)(b) GDPR for questions about the app or a purchase, otherwise Art. 6(1)(f) GDPR). We delete this correspondence when it is no longer needed, unless statutory retention periods apply.

9. Transfers to the USA

Netlify and RevenueCat are based in the USA. Transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Because vault content is stored only on your device, you can view, export and delete it yourself at any time; we cannot access it.

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

To exercise your rights, email purevault-support@whitoutcookies.dedyn.io.

11. Further information

You are not legally or contractually required to provide personal data. Without the purchase data described above, the one-time purchase cannot be validated or restored; all free features work without it. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

We update this policy when the app, the website or the law changes. The current version is always available on this page.