Privacy Policy

1. Summary

Vaulty (“Vaulty”, “we”, “us”), provided by Incy, LLC, has no servers, no user accounts, no analytics, and no trackers. We do not collect, transmit, sell, or share any personal data. There is nothing for us to collect because the app runs entirely on your device.

2. Information we do not collect

We do not collect names, email addresses, device identifiers, usage analytics, crash telemetry, advertising identifiers, location, or your two-factor authentication secrets. Vaulty contains no third-party analytics or advertising SDKs.

3. Where your data lives

• 2FA secrets are stored on your device in the Apple Keychain, protected by the Secure Enclave and your device passcode or biometrics (Face ID / Touch ID).
• iCloud sync (Pro) uses Apple's iCloud Keychain. Data is end-to-end encrypted by Apple with keys only your devices hold. We have no access to it.
• Automatic backups (Pro) are encrypted on your device with AES-256-GCM before being written to your iCloud Drive. The encryption key never leaves your Apple Keychain.
• Manual backup files are encrypted with AES-256-GCM using a password you choose. Anyone without the password — including us — cannot open them.
• App settings (theme, folders, preferences) are stored locally in the app's own storage on your device.

4. Service brand icons

When an account has no bundled brand icon, Vaulty may fetch a favicon directly from the service's own website (for example github.com) to display next to the account. These requests go straight to the service's domain — never to a third-party favicon aggregator — and reveal only that a favicon was requested. Results are cached on your device. You can disable this by choosing a specific icon for the account.

5. Apple services and purchases

Purchases (the Vaulty Pro subscription and optional tips) are processed entirely by Apple through the App Store. We never receive your payment details. Apple's privacy policy governs the transaction itself: apple.com/legal/privacy.

6. Widgets, Apple Watch, and AutoFill

Codes shown in widgets, on Apple Watch, and via AutoFill are generated locally on your devices. Nothing is transmitted to us or any third party.

7. Children's privacy

Vaulty is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). Because we collect no personal data from anyone, we do not knowingly collect data from children.

8. Your rights

Because we hold no data about you, there is nothing for us to disclose, correct, or delete on our side. Deleting the app — and, if you enabled it, removing your Vaulty iCloud data through iOS Settings — removes everything. Where laws such as the GDPR or CCPA grant you data rights, those rights are satisfied by the fact that we are not a data controller or processor of any personal data.

9. Changes to this policy

If this policy changes, the updated version will be published on this page with a new effective date. Material changes will never be applied retroactively.

10. Contact

Questions about privacy? Email vaulty@redstone.ltd.