Privacy Policy

HypaVault does not send us, and we do not collect, store or have access to:

• your files, photos, videos, voice recordings, documents, notes, seed phrases or any other content you store;
• your vault names, folder names or file names;
• your passcodes, patterns, recovery phrases or encryption keys;
• your contacts, location or browsing activity;
• advertising identifiers, analytics or usage data from within the App.

HypaVault has no user accounts, no sign-in, no advertising, no analytics software, no software that tracks you, and no servers that receive your content.

Everything you put in HypaVault is encrypted and stored locally, in the App’s private storage on your device (on iPhone, files in the App’s own container that other apps cannot read). This includes your vault content, settings, plan status, and the counts used for Free plan limits. This information never leaves your device unless you choose to export, back up, share or sync it, and even then it is sent only where you send it, in encrypted form.

On iPhone, part of each encryption key is a device key stored in the iOS Keychain, marked for this device only. It never leaves the device and is not included in iCloud or computer backups.

On Android, part of each encryption key is a device key stored in the App’s private storage, encrypted by a non-exportable Android Keystore key. It never leaves the device and is not included in Google backups.

If you back up your iPhone to iCloud or a computer, that backup may include HypaVault’s encrypted data. Apple’s terms and privacy policy govern those backups. Because the device key is not included, the data cannot be opened from the backup alone: on a new iPhone, each vault opens only with its recovery phrase.

On Android, HypaVault’s data is left out of Google’s cloud backup. If you move to a new phone with Android’s device-to-device transfer, HypaVault’s encrypted data may be copied across, but the device key is not, so each vault opens on the new phone only with its recovery phrase.

A few display preferences, such as the language last shown and the size of the photo grid, are kept on your device without encryption. They say nothing about what you store.

Because this information stays on your device and is encrypted with keys we do not have, we cannot access, read, change, export, delete or restore it, and we cannot provide it to anyone, including in response to a legal request.

• Support requests. If you email us at mail@hypavault.com, we receive your email address, your message and anything you attach. Please do not send us passcodes, recovery phrases or other sensitive information. We cannot use them to help you, and we will never ask for them.
• Purchases. Pro is bought through the Apple App Store or Google Play, which process the payment under their own privacy policies. We do not receive your name, store account or card details. To provide Pro, the App checks your purchases through RevenueCat, as described in the next section.
• Diagnostic reports. If something goes wrong, you can choose Send Diagnostic Report in the App. It opens your email app with a report you can read, change or delete before sending to mail@hypavault.com. It holds the App and operating system versions, your device model, its memory and free space, the version of the App’s storage format, the date and result of the open vault’s last integrity check, and the last errors since the App started, with any quoted text removed. It never includes your content, file or vault names, settings, or how many vaults or files you have. Nothing is sent unless you send the email.
• Store statistics and crash reports. If you have allowed it in your device or store settings, Apple or Google may share aggregated statistics or crash reports with us. These are governed by their policies and do not include your vault content.

When you buy or restore Pro, and from time to time when the App opens, the App checks your purchases with RevenueCat, Inc., a company in the United States that handles in-app purchases for us as our service provider (data processor). RevenueCat receives:

• a random identifier that RevenueCat’s software creates for the App on your device. We never link it to your name, email or store account, and the App sends no other identifier of ours;
• the store’s record of your HypaVault Pro purchases: the product, price, currency, dates, renewals, cancellations and refunds, and the store’s transaction identifiers;
• technical details sent with each request: the App and operating system versions, the device model, language and region settings, your store’s country and, on iPhone, the vendor identifier Apple gives the App; and, as with any internet connection, your IP address.

RevenueCat does not receive your vaults, files, notes, vault names, passcodes, recovery phrases or encryption keys. We use this information only to provide and restore Pro, to keep purchases working, and to see how Pro sells. RevenueCat processes it under its agreement with us and its own privacy policy (www.revenuecat.com/privacy). It keeps purchase records while we use its service, so that purchases can be restored, unless you ask us to delete them.

To ask us to delete RevenueCat’s record of your purchases, email mail@hypavault.com with the order ID from your store receipt; without it we cannot tell which record is yours. Your purchase itself stays with your store account, and Restore Purchases brings it back.

HypaVault asks for permissions only when a feature needs them, and uses them only on your device. Nothing they give access to is sent to us:

• Camera, to take photos and videos directly into a vault and to scan pairing codes for sync.
• Microphone, to make voice recordings and to record sound with videos you take in the App.
• Photos, to import the photos and videos you choose into a vault, and to save the ones you choose to export to your photo library.
• Files, to import documents you choose and to save backups and exports where you choose. No permission is needed: you pick each file.
• Local network, to find and sync directly with another of your devices on the same Wi-Fi.

You can withdraw these permissions at any time in your device settings. Some features will then stop working.

We use the limited information we receive only to answer your support requests and diagnostic reports, to provide Pro features you have purchased, to keep the App working and secure, to comply with our legal obligations, and to protect our rights. We do not sell your information, use it for advertising, or build profiles about you.

Where data protection law requires a legal basis, we rely on: performing our contract with you (for example, providing Pro); our legitimate interests in supporting and securing the App, balanced against your rights; your consent, where you give it, which you can withdraw at any time; and compliance with legal obligations. Where the Digital Personal Data Protection Act, 2023 of India applies, we process personal data you give us, such as a support email, for the purpose you provided it for.

We do not sell, rent or trade personal information, and we do not share it for advertising. We may share the limited information we hold only with service providers that help us run the App (RevenueCat for in-app purchases, and our email provider for support), under confidentiality obligations; when required by law or valid legal process; to protect our rights, users or the public; or as part of a merger, acquisition or sale of assets.

We cannot share your vault content with anyone, including authorities, because we never have it or the keys to decrypt it.

We keep support emails and diagnostic reports only as long as needed to answer them and to meet legal or accounting obligations, then delete them. Purchase records at RevenueCat are kept as described in “Purchases and RevenueCat”. Data on your device stays there until you delete it, erase a vault, enter a duress passcode (which erases every other vault), clear the App’s data or uninstall the App. Deletion is permanent and cannot be undone by us.

HypaVault encrypts your content on your device. However, no method of storage, encryption or transmission is completely secure. We cannot guarantee the security of your data, and you are responsible for protecting your device, passcodes, recovery phrases and backups. As set out in our Terms of Service, to the maximum extent permitted by law we are not liable for any leak, disclosure, unauthorised access, decryption or loss of your data.

Depending on where you live, including under the EU and UK GDPR, the Digital Personal Data Protection Act, 2023 of India, and US state laws such as the California Consumer Privacy Act, you may have rights to access, correct, delete or receive a copy of personal data we hold about you, to object to or restrict its processing, to withdraw consent, to nominate someone to exercise your rights, and to complain to a data protection authority.

The only personal data we normally hold is what you send us by email, and the purchase records RevenueCat keeps for us. To exercise your rights, contact mail@hypavault.com. We may need to verify your request. Data stored in HypaVault on your device is fully under your control: you can view, export or delete it yourself at any time, and we have no way to access it.

HypaVault doesn’t use accounts, so there is nothing to delete with us. To delete everything HypaVault holds on a device, use Erase This Vault in Settings for each vault, or delete the App.

In India, if we have not resolved your grievance, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

We do not sell or share personal information as those terms are defined under California law.

HypaVault is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has sent us personal information, contact us and we will delete it.

We are based in India. If you contact us, your email may be processed in India or in other countries where our email provider operates. Purchase records are processed by RevenueCat in the United States. Where required, we use appropriate safeguards for such transfers.

When you save a backup to a cloud drive, share a file through another app, or buy Pro through an app store, that service’s own terms and privacy policy apply. We are not responsible for their practices.

We may update this Privacy Policy from time to time. We will post the updated policy in the App or on our website and change the effective date above. If a change is material, we will take reasonable steps to let you know.

This section covers the HypaVault website you are reading now. The App contains no analytics; the website collects only the following:

• It has no accounts or sign-in and shows no advertising. It uses Google Analytics to measure visits and which pages are read. Google Analytics sets cookies in your browser and receives your IP address, device and browser details and the pages you view, under Google’s own privacy policy. You can block it with your browser’s settings or Google’s opt-out add-on.
• The free privacy tools run entirely in your browser. Passwords you test and photos you check with the Photo Metadata Remover are never uploaded. The Seed Phrase Safety Checklist and the Phone Privacy Audit save your progress, and the Guides remember which guides you’ve opened, in your browser’s local storage, on your device only, and you can clear it at any time.
• Forms on the website open your own email app with a message addressed to mail@hypavault.com. Nothing is sent until you send it, and we receive only what you choose to send.
• The website’s typeface is served from the website itself, so showing it involves no third-party font service.
• Like any website, our hosting provider processes your IP address and basic request details to deliver pages and keep the site secure.

Links to the App Store, Google Play and other websites are governed by those services’ own terms and privacy policies.

For privacy questions, requests or complaints, including under the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023, contact our Grievance Officer:

• Name: [TO COMPLETE: Grievance Officer’s full name]
• Email: mail@hypavault.com
• Post: Grievance Officer, Cyberdune Technologies Private Limited, [TO COMPLETE: registered office address, Mumbai, Maharashtra, India, with PIN code]

We will acknowledge your complaint within 24 hours and resolve it within 15 days of receiving it, or sooner where the law requires.

Cyberdune Technologies Private Limited, CIN [TO COMPLETE: Corporate Identity Number (CIN)]. Website: www.cyberdunes.com.