HushVaultHushVault Privacy Policy
The short version
HushVault is built so that your photos and videos never leave your phone and nobody, including us, can see them.
- We do not collect, store or see your photos, videos, patterns or recovery phrases.
- There are no accounts, no advertising, no analytics and no tracking.
- The only outside service the app talks to is RevenueCat, and only to check whether you've bought HushVault Pro.
What stays on your phone
Everything you put in HushVault is encrypted on your device with AES-256-GCM before it is saved. The keys are unlocked by your pattern combined with a secret kept in your phone's secure hardware. We have no copy of your pattern, your keys or your files, and no way to get them.
The app also stores on your phone:
- Settings, such as your chosen app icon and whether originals are deleted after import.
- A counter of wrong pattern attempts, used to slow down guessing.
- A biometric unlock key, if you turn on fingerprint or face unlock. It is kept by your phone's operating system in its secure storage. HushVault never receives your fingerprint or face data; the operating system only tells the app whether the check passed.
Backups you export are single encrypted files. You choose where they go (for example Google Drive, iCloud Drive or your computer). They can only be opened with that vault's 24-word recovery phrase, which is shown to you once and never stored by the app.
Permissions
- Photos and videos. You choose items through the system photo picker; the app only receives the items you select. If you turn on "Delete originals after import", your phone asks you to confirm each deletion. If you restore an item, it is saved back to your gallery.
- Fingerprint / face. Used only if you turn on biometric unlock, as described above.
- The app does not use your camera, microphone, location or contacts.
Purchases (HushVault Pro)
Payments are handled by Google Play (and the Apple App Store on iPhone). We never receive your card or payment details.
To manage subscriptions we use RevenueCat, Inc. When the app starts, and when you buy or restore a purchase, RevenueCat receives:
- an anonymous, randomly generated app user ID (not your name or email),
- your purchase and subscription history for HushVault,
- basic technical information such as device model, operating system and app version, country, and the IP address your connection comes from.
This is used only to confirm whether HushVault Pro is active on your device. RevenueCat's own privacy policy: www.revenuecat.com/privacy
Google's privacy policy applies to purchases made through Google Play: policies.google.com/privacy Apple's privacy policy applies to purchases made through the App Store: www.apple.com/legal/privacy/
What we don't do
- We don't sell or share personal data.
- We don't show ads or use advertising identifiers.
- We don't use analytics or crash-reporting services.
- We don't have servers that hold your data.
Keeping and deleting data
Your vault data stays on your phone until you delete it in the app or uninstall the app. Uninstalling removes the vaults and the device secret, so the encrypted files cannot be opened again without a backup and its recovery phrase.
RevenueCat keeps purchase records as long as needed to provide your purchases and meet legal and accounting obligations. You can ask us to request deletion of the anonymous RevenueCat record linked to your device by contacting us.
Security
Encryption happens on your device, and the keys never leave it. If you forget your pattern and have no backup with its recovery phrase, your vault cannot be recovered by anyone, including us.
Children
HushVault is not directed at children under 13 (under 16 in the European Union), and we do not knowingly collect information from children.
Your rights
Depending on where you live (for example under the GDPR in the EU/UK or the CCPA in California), you have rights to access, correct, delete or object to the processing of your personal data. Because we don't hold personal data about you, most requests only concern the anonymous purchase record held by RevenueCat. Contact us at support@hushvault.io and we will help.
Changes to this policy
If this policy changes, we'll update the effective date above and, for significant changes, mention it in the app's release notes.
Contact
CodeSorcery is responsible for the protection of personal information related to HushVault, including under Québec's Act respecting the protection of personal information in the private sector. Questions, requests and complaints: support@hushvault.io