Pic Vault Privacy Policy

This policy covers Pic Vault: Hide Photos for iPhone and iPad, published by Turbo Ventura of Dubai, United Arab Emirates. It is the policy referenced by the app’s App Store listing.

The company and this website are covered by our general privacy policy; where the two overlap, this page is the more specific and it governs the app.

For anything here, write to [email protected].

Everything you put into Pic Vault is encrypted on the device before it is written to storage. We run no service you log in to and no server that receives your vault. The one server the app does talk to is described in section 3; the following never reaches it, or us, and there is no mechanism in the app by which it could:

• Your photos, videos, notes, voice memos, documents and records.
• File names, album names, search terms and the structure of your vault.
• Your passcode and the passphrase of any backup. Your recovery code leaves the device only if you ask for it to be mailed to you after forgetting your passcode (section 9).
• Your browsing history, bookmarks and downloads in the private browser.
• The log of failed unlock attempts, the codes that were tried, and any intruder photo taken.

Files are encrypted with 256-bit ChaCha20-Poly1305, each under a key of its own; the master key is sealed with your passcode and, separately, with your recovery code. Server passwords and the passcode check are held in the iOS Keychain. Deleting the app removes the vault and everything in it.

Pic Vault talks to one server of ours, app.turbocloud.systems, which our apps share. It is how a notification reaches you, how a support conversation works, and how the app learns its current settings. It never receives anything from your vault.

Only while a vault is open

The app speaks to this server only while a vault is open and no disguise is on screen. While the app is locked, and behind the calculator, clock or notepad, it sends nothing at all. There is one exception: when you choose or remove a disguise in Settings, the app tells the server that a disguise is in use before the disguise goes on, so that the server stops sending visible notifications (section 4). For this app, opening the vault is what a launch is: the app checks in then, and again when you come back to it.

The device record

Each check-in sends a record of this installation:

• Random identifiers we create. A device identifier — a random value kept in the iOS Keychain and shared by our apps on the same iPhone or iPad, so it survives deleting and reinstalling the app; an installation identifier that changes with every fresh install; an account identifier, also random, which iCloud Keychain carries to your other devices if you use it, so that we can tell one person’s devices from several people’s; and a random secret that proves later requests come from the same installation. None of them is derived from your name, your Apple Account or your phone number.
• Apple’s identifiers. The identifier for vendor (IDFV), and the advertising identifier (IDFA) only if you have allowed tracking, together with the answer you gave. If you have not allowed tracking, no advertising identifier is sent.
• The push token Apple issues for notifications, which of Apple’s gateways issued it, and whether notifications are allowed, refused or not yet asked.
• The device and the app: the model identifier (such as “iPhone15,2” — never the name you gave the device), the iOS version, phone or tablet, the app’s version and build, the language you use the app in, and your time zone.
• Our other apps. Which of our other apps are on the same device, when each was first and last opened, and its version, read from a folder our apps share — so that we do not advertise an app you already have. Those apps report Pic Vault the same way.
• One setting: whether a disguise is chosen. Nothing else about how the app is set up — not whether there is a decoy, a rescue address or a break-in photo, and not how much is in the vault.

Like any server, ours sees the IP address a request comes from. From it the server derives an approximate location — country, region, city and network provider — and stores it with the device record, to choose the settings and messages for your country and to send a notification at a sensible hour; the country is sent back to the app. The app itself never sends a location.

Other requests

• Settings — advertising placements, free-tier limits, whether an update is available, the browser’s start page. This request carries the app version, platform, iOS version, phone or tablet and language, and no identifier.
• Messages inside the app — on an open, in the real vault only, the app asks whether there is a message to show, with the device identifier, app version, language, iOS version and phone or tablet. If one is shown, the app reports that it was seen, which button was tapped, or that it was closed.
• Notification taps are described in section 4, support in section 5, and purchases in section 8.

There is no switch for the device record: it is how notifications, support replies and the app’s settings reach this device. Deleting the app stops it.

Pic Vault sends two kinds of notification: our reply to a message you sent us, and occasional news about the app. The app never asks for marketing consent, so it is not sent promotional campaigns.

When you are asked

iOS asks your permission only when you choose: from Notifications in the app’s Settings, from the offer in a support conversation after you have sent a message, or when you set an alarm or timer in the clock disguise (those alarms are scheduled on the device and involve no server). Never at first launch. You can turn notifications off at any time in iOS Settings.

Whatever your answer, iOS gives the app a push token, which goes to our server with the device record. With notifications off, a reply from us arrives silently: it updates the count in the app and shows nothing.

Behind a disguise

While a disguise is chosen, the server sends no visible notification: news is not sent, a reply arrives silently, and the app icon carries no badge. A tap on a notification behind a disguise does nothing; a tap on the lock screen waits until the vault is unlocked; and in the decoy a reply opens nothing.

What a notification shows

Never anything from your vault. News shows the text we wrote, and sometimes a picture. A reply shows the app’s name, the subject of your conversation and our answer, so it can be read on the lock screen; iOS’s Show Previews setting decides whether it is. A link in a notification opens in the vault’s private browser, not in Safari.

A picture is fetched by the app’s notification extension from our server as the notification arrives. That request carries no identifier, only the picture’s random address. The extension sends nothing else and does not report that the notification arrived.

What is reported back

When you tap a news notification, or one of its buttons, the app reports that tap — which notification, which button, and when — with the device identifier, once you are inside the vault. Nothing is reported when a notification arrives or is dismissed, and nothing for a reply from us.

Contact Us opens a conversation with us inside the app, in the real vault only.

• What is sent: the topic you pick, the subject and message you write, and any picture you attach, with the device identifier — which is how our reply finds this device, and how we see the device record in section 3 next to your message. The app does not ask for your name or e-mail address and adds nothing about your vault.
• Pictures, up to three a message, come from the iOS photo library through Apple’s picker, which shows the app only the picture you choose. Nothing in your vault can be attached. Before sending, the picture is re-encoded at a reduced size and its metadata, location included, is removed.
• Replies appear in the conversation, and as a notification if you allow it (section 4). A message you have written but not yet sent stays in the vault’s encrypted storage.
• When the conversation is not available — before the server has answered, or in the decoy — Contact Us opens your own mail app instead, addressed to [email protected], with the app version, iOS version, device model, language and whether you use the free or Pro version written under your message, where you can see it. You send that mail yourself; we receive only what you send. It never says whether a disguise, a decoy or a rescue address is set, or how much is in the vault.

To understand which parts of the app are used and where it fails, Pic Vault sends usage events through Google Analytics for Firebase and crash reports through Firebase Crashlytics. Google acts as our processor for both. There is no switch for them in the app.

What is sent

• That the app was opened, and that a feature was used: a tool, playback of audio or video, a disguise chosen and of which kind, an import with how many files and from where (never which files), that the paywall or a free-tier limit was shown and how it was passed, that a purchase was made, that the contact screen was opened and how it ended, and that a recovery link was opened.
• The device model, iOS version, app version, language and country, and a pseudonymous app-instance identifier generated by Firebase.
• For a crash: the stack trace, the state of the app at that moment, and the same device fields.

What is never sent

No event carries content: no file names, album names, search terms, web or server addresses, and nothing you have typed — the codes tried in a break-in included. We never set a user identifier in Firebase, and advertising storage and ad-personalisation signals are switched off for analytics. Firebase starts with the app, so the fact that the app was opened is counted even behind a disguise.

Google retains this event data for a bounded period and processes it under its own terms.

The app can show advertising supplied by Google AdMob, and by the mediation partners AdMob may pass a request to when it does not fill an ad itself: AppLovin, Pangle, Liftoff Monetize, DT Exchange and InMobi. Each is an independent controller of the data it receives, under its own policy:

• Google (AdMob)
• AppLovin
• Pangle
• Liftoff Monetize
• DT Exchange (Digital Turbine)
• InMobi

Ads are only requested after the vault is unlocked, never while the app is disguised, and never inside the vault’s content.

To request, show and measure an ad, these SDKs may process your device’s advertising identifier (IDFA, only if you allow it), the IDFV, IP address, device and operating-system information, a coarse location derived from that IP address, and your interaction with the ad. Nothing from your vault is ever part of an ad request. If you allow tracking, the advertising identifier also goes to our own server with the device record (section 3).

• App Tracking Transparency. iOS asks your permission before the advertising identifier may be used. Decline and ads are non-personalised. You can change the answer in Settings › Privacy & Security › Tracking.
• Consent in the EEA, the UK and Switzerland. Where required, Google’s consent form (UMP) is shown before personalised advertising is enabled, and your choice is passed to the partners above.

Pic Vault Pro is sold through Apple’s In-App Purchase system using StoreKit. Apple takes the payment and holds the payment details; we never see your card, your billing address or your Apple Account credentials. Refunds are handled by Apple at reportaproblem.apple.com.

When money moves — a purchase or the start of a free trial, a renewal, or a refund — the app reports it to our server with the device identifier: which product, the price and currency, Apple’s transaction number, and whether it was a real or a test purchase. That is how our server knows which installations are Pro, and whether a notification led to a purchase. A restore, a tap on a plan you already own and a Family Sharing purchase are not reported. A report waits, encrypted on the device, until the vault is next open.

A rescue e-mail address is kept only on your device, sealed with your passcode and your recovery code. Adding one sends nothing.

• When you add the address and choose to e-mail yourself the code, the app opens your own mail app with the message written. You send it from your own account, and it does not pass through us.
• If you forget your passcode and ask for the code to be mailed, the app sends the address and the recovery code over HTTPS to our mail relay, sealed so that only the relay can open them, with the app’s language so the mail is written in it. The relay uses them to deliver that one message. Nothing else about you or your vault is sent, and nothing at all from the decoy or from behind a disguise.

In every case the connection goes from your device straight to the service you chose — it does not pass through us, and we receive no copy of anything.

• Cloud accounts (Google Drive, Dropbox, Yandex Disk): you sign in with the provider’s own screen, and the token it hands the app is stored in the Keychain. We never see your password.
• Your own server (WebDAV, Nextcloud, ownCloud, SMB, SFTP, FTP, S3): the address and credentials you enter are stored in the Keychain and used to talk to that server directly.
• Encrypted backups are encrypted on the device with a backup passphrase before they are uploaded. The service stores ciphertext it cannot read.
• Wi-Fi transfer runs only on your local network, is gated by a PIN, runs only while its screen is open, and stops when the vault locks.
• The private browser talks to the sites you visit like any browser would; those sites see your IP address and the requests you make.

Each request happens only when you use the feature that needs it, and declining one disables that feature and nothing else.

• Face ID / Touch ID — to unlock the vault. The biometric match happens inside iOS; the app never receives your face or fingerprint.
• Photos — to move photos and videos into the vault, to let iOS delete the originals, and to save an exported file back.
• Camera — for the private camera, and, if you turn it on, to photograph whoever fails to unlock the vault. iOS shows the camera indicator whenever it is used.
• Microphone — to record voice memos into the vault.
• Contacts — to copy contacts you choose into the vault.
• Location — only if you mark safe places, and only at the moment you unlock. Location is never stored off the device and never opens the vault.
• Local network — for Wi-Fi transfer and to reach a server on your own network.
• Notifications — for our replies to your messages, news about the app, and the clock disguise’s alarms and timer. Asked only when you turn them on — see section 4.
• Tracking — see section 7.

• Your vault — on your device until you delete it or remove the app. Items in the bin are removed after the period you set.
• Backups — on the service you chose, until you delete them there.
• The device record and support conversations on our server — kept for as long as needed to provide these features.
• Purchase reports — kept for as long as accounting and tax law requires.
• Analytics and crash events — retained by Google for a bounded period (section 6).
• Advertising data — retained by each partner under its own policy.

To have our server’s record of your device or your support conversations deleted, write to [email protected], or ask in the app’s support conversation.

We hold no copy of your vault and no key to it, so we cannot recover, read or delete its contents for you — only your passcode or your recovery code can open it.

Pic Vault is a general-purpose tool and is not directed at children under 13, or the equivalent minimum age where you live. We do not knowingly collect personal data from them; the app has no account and asks for no name or e-mail address, and the record in section 3 holds random identifiers, not a name.

Depending on where you live you may have the right to access, correct or delete personal data we hold about you, to restrict or object to its processing, to withdraw a consent you gave, and to complain to your supervisory authority — under the GDPR (EEA and UK), the KVKK (Türkiye), the CCPA/CPRA (California) and the UAE Personal Data Protection Law, among others.

We do not sell personal data. The device record in section 3 is used to deliver notifications and support replies, to choose settings and messages by language, country and app version, and to count how many devices use the app. To exercise a right, write to [email protected]. There is no account, so the surest way for us to find what is yours is a request sent from the app’s support conversation, which reaches us under this device’s identifier.

Our server and our mail relay, Apple’s Push Notification service, Google, the advertising partners in section 7 and the services you connect may process data outside your country, including in the United States. Where that happens, it is under the transfer mechanisms the law provides and that each provider sets out in its own policy, such as the EU Standard Contractual Clauses.

When this policy changes materially — a new processor, a new category of data — the date at the top changes with it, the App Store privacy labels for Pic Vault are updated to match, and the change is described here before the version of the app that makes it is released.

Privacy questions and data requests: [email protected]
Help with the app: [email protected]
Legal notices: [email protected]

Turbo Ventura
Dubai, United Arab Emirates