Privacy policy

Last updated October 19, 2026

ShyVault is made by AZ Digital Inc. ("we"). This policy covers the ShyVault app for iPhone and iPad and this website. The short version: there is no account, no advertising and no tracking, and the files you keep in ShyVault are encrypted on your device with keys we never have.

What stays on your device

Photos, videos, documents and notes you add to a vault are encrypted on your device before they are saved. The keys come from the pattern you draw, which is never stored. Each vault's recovery phrase is kept inside that vault, encrypted. We can't open your vaults, list them, or tell how many you have, and neither can anyone else without the pattern or the recovery phrase.

ShyVault asks for the camera and microphone so you can take photos and videos straight into a vault, and for your photo library so it can save exports there, remove originals you've moved into a vault, and finish an import that was interrupted. All of this happens on your device. Nothing from your photo library is sent to us.

When you add files with the Share button in another app, ShyVault encrypts them right away and keeps them in a private folder on your device until you choose a vault for them.

iCloud backup

Each vault backs up to your own iCloud account unless you turn this off in the vault's settings. Before anything is uploaded, it is encrypted on your device and split into pieces padded to set sizes, so the backup reveals neither what's in your files nor their exact sizes. The backup is stored in ShyVault's private iCloud database for your Apple Account, which Apple operates under its own privacy policy. We can't access your private iCloud data. Only the vault's recovery phrase can open the backup on another device.

Turning backup off stops new uploads. To delete what's already in iCloud, go to Settings, then your name, then iCloud, then Manage Account Storage (or Manage Storage), then ShyVault, and delete its data.

Shared vaults

When you share files privately in ShyVault, copies of them are encrypted on your device with a key that comes from the twelve-word sharing code, and stored in ShyVault's public iCloud database. Without the code they can't be read, by us or by anyone else. Apple attaches an anonymous identifier to records you create there. It doesn't tell us who you are, but it's the same for every share you create, so someone holding the codes to two of your shares could tell they came from the same person. The shared copies are deleted when you stop sharing, or when the share expires and you next open the vault it came from. A small signed marker stays behind so that devices which joined know the share ended.

Anyone with the code can open the shared vault, so send it only to the people it's for. The page that sharing links open on this website keeps the code in the part of the address after the "#", which browsers never send to our server.

Purchases

Apple handles payment for ShyVault Pro. We never see your name, Apple Account or payment details. To check whether Pro is active, the app uses RevenueCat, which receives a random identifier created by the app, your purchase and subscription history, your device's country and currency, basic device information such as the iOS version, and your IP address as part of the connection. We use this only to provide and restore your purchases. It isn't linked to your identity and isn't used for advertising.

No analytics or tracking

The app has no analytics, crash reporting or advertising code, and doesn't ask to track you. If ShyVault crashes, Apple shares a crash report with us only if you've chosen to share analytics with app developers in your iPhone's settings.

Email to support

If you write to support@shyvault.app, we receive your email address and whatever you send. We use it only to reply, and delete it when you ask.

This website

This website uses no cookies, analytics or third-party scripts, and its fonts are served from the site itself. Like any web server, our hosting provider records IP addresses and requested pages in short-lived logs to keep the site running and secure.

Services we use

• Apple iCloud (CloudKit) stores iCloud backups in your own iCloud account and shared vaults in ShyVault's public database, always encrypted.
• Apple App Store handles purchases, subscriptions and refunds.
• RevenueCat checks which purchases are active, as described above.
• Our website host serves this site and keeps short-lived access logs.

Requests from authorities

We can't hand over the contents of vaults, backups or shared vaults, because we don't have the keys to read them.

Your choices and rights

Because ShyVault has no accounts, we hold almost nothing about you. You can delete vaults in the app, delete iCloud backups as described above, and cancel subscriptions in your Apple Account settings. Depending on where you live, you may have rights to access or delete personal data; write to us and we'll help with anything we hold, such as support emails.

Children

ShyVault doesn't collect personal information from anyone, including children.

Changes

If this policy changes, we'll update this page and the date at the top. If a change affects how your data is handled, we'll also say so in the app.

Contact

AZ Digital Inc., support@shyvault.app