AlterVault Privacy Policy.

The short version

AlterVault has no accounts, no cloud storage, no sync and no server of our own. Everything you put in the vault is encrypted on your device and stays there. We never receive your photos, videos, documents, file names, dates, passcode or recovery phrase — not in any form, encrypted or otherwise.

The app makes three kinds of network request. Two happen only when you ask for them: a purchase check with RevenueCat when you reach the upgrade screen, Settings, or tap Restore Purchases; and a feedback message when you tap Send on the Feedback screen. The third is a short, fixed list of anonymous usage events sent to PostHog so we can see where people get stuck — which screen of setup, whether an import or a purchase went through, and whether the app crashed. Those events never contain anything from your vault, and section 8 lists every one of them. There is no advertising SDK and no tracking.

What the app does with your data

1. The contents of your vault

Items you import are encrypted on your device with XChaCha20-Poly1305 and written into the app's own private storage. The key is derived from the passcode you choose and, on hardware that supports it, bound to that device's Secure Enclave, so the stored data is useless on any other device. The index of your vault — file names, sizes and dates — is encrypted as well, because that is exactly the information the vault exists to protect.

None of it is uploaded, backed up by us, or transmitted anywhere. We operate no servers for AlterVault, so there is no system of ours that could receive it.

2. Photo and media library access

Choosing photos or videos to import uses the system picker, which hands the app only what you select and needs no permission to your library. Nothing is scanned, uploaded or analysed. The app never deletes anything from your photo library on its own: on iOS, Settings has an Ask to Delete Originals switch, off by default, and when it is on the app asks after an import whether to remove the originals — that is the only time it requests photo library permission, and iOS confirms the deletion itself.

3. Files you import from other apps

When you import through the Files picker, the system places a plaintext copy of your file inside the app's own container and hands that copy to the app. It is encrypted into the vault and the copy is deleted immediately afterwards, along with a sweep at every launch and every lock in case the app was killed mid-import.

4. Sharing an item out of the vault

When you share or export an item, the app decrypts it into a temporary folder in the system cache and hands that file to the iOS share sheet — there is no other way for another app to receive it. That temporary file is deleted as soon as the share sheet closes, and swept at launch and on every lock. It is never written to a location that is backed up to iCloud. Once you hand a file to another app, that app's own policies apply to the copy it keeps.

5. Motion sensor

The app reads the accelerometer to detect the shake gesture. Motion data is evaluated on the device in the moment and is never recorded, stored or transmitted.

6. AlterVault Pro purchases

AlterVault Pro is an optional one-time purchase. Payment is processed entirely by the store you installed from — Apple's App Store or Google Play; we never see or store your card details, name or email, and buying does not create an account.

We use RevenueCat to load the price and validate the receipt. RevenueCat receives an anonymous identifier that it generates itself, the store's receipt or purchase token, and basic technical information about the request: device model, operating system version, country, locale and the IP address. We do not send RevenueCat an email address or anything derived from your passcode, your recovery phrase or the contents of your vault. The app contacts RevenueCat when you reach the passcode step of setup (so the price is ready on the screen that follows), when you open the upgrade screen or Settings, and when you buy or tap Restore Purchases — never at launch and never in the background.

Ads in the App Store. If you installed AlterVault by tapping one of our ads in the App Store, Apple tells us which ad and search term led to the install. We use this only to see which ads work. It is tied to the same anonymous identifier as purchases, never to your name, email or Apple ID. It is not used to track you across apps, and it never includes anything from your vault.

7. Feedback you send

Settings has a Feedback screen. If you write a message there and tap Send, the app posts it to a private Discord channel where we read it. It carries the message you typed, whether you marked it as a bug, an idea or something else, the app version and your operating system version — nothing else: no name, no email, no device identifier, and nothing about your vault. Discord also sees the IP address the request comes from. Nothing is sent when you open the screen, only when you tap Send.

After you have used the app for a while it may ask, once, whether you are enjoying it. Saying yes opens the store's own rating prompt, handled by Apple or Google; the app receives nothing back.

8. Anonymous usage events and crash reports

The app sends a small, fixed set of anonymous events to PostHog, a product-analytics service, so we can see where people get stuck between installing the app and using it. This is the one thing the app sends without you tapping something. The complete list:

• the app was opened, whether setup was already finished, whether the upgrade is owned, and whether the shake gesture is on and at which sensitivity;
• a setup step was reached, the back button was pressed during setup, the recovery phrase was put off for later, and setup was finished;
• the upgrade screen was shown, closed, and where it was opened from;
• a purchase or a restore was started and how it ended, how many seconds that took, and the store's error code if it failed or was cancelled;
• an import was started, cancelled, picked back up after the app restarted, failed, or finished, with how many items were chosen, added, failed or did not fit, how many seconds each step took, and the error code and its general kind if it failed — never the error message, which could name a file;
• the library could not be opened, with the step that failed, the error code and its general kind, whether the index file was present and its size, and whether the fallback reader could open it — never the message, never a name, and never which library;
• a record in the library had no file behind it and was dropped, by count; a write to the library failed, with where and what kind;
• one item of an import did not land, with the step it failed at, the error code and kind, and the file's size rounded to megabytes — never its name;
• a code entered at the lock screen opened nothing, with the running count of failed attempts and whether a wait started — never the code;
• whether you chose to delete or keep the originals after an import, and whether the setting that asks was switched on or off (iOS);
• the free item limit was reached, and an item past it was opened, without anything about the item;
• the vault was unlocked with a code, without the code itself, and locked again — by leaving the app, by the auto-lock delay or by the Lock row;
• the "Enjoying AlterVault?" question was shown, whether you tapped yes or no or closed it, and which reason you picked from the list after a no;
• a feedback message was sent, without its text;
• the shake gesture was used, and how many seconds after the app was unlocked;
• the app stopped while it was on screen — a crash or the system closing it — reported the next time it opens, with the reason the operating system recorded (on Android: for example low memory or a crash), what the app was doing (importing, viewing an item, or nothing in particular), how long it had been open, how much memory it was using, and the system's own short description of the stop; and an error inside the app that nothing handled, with the error's type and its message. Both are checked before sending so that no file name or path is included, and neither says which library was open.

Each event carries a random identifier generated on your device, the app version, your operating system and its version, the time, and which of two versions of the free limit this install was given (the app is testing which one people prefer). PostHog also sees the IP address the request comes from and derives a country from it.

These events never contain your photos, videos or documents, their file names, your passcode, your recovery phrase, or which gallery is open. We do not record your screen, your taps or your keystrokes, and we never attach a name, an email address or an account to the identifier. It is stored inside the app and is deleted when you delete the app. There is no separate crash-reporting SDK: the two events about the app stopping are part of this same list.

9. What is stored on your device

AlterVault stores the following on your device only:

• Your encrypted vault: the items themselves, their thumbnails and the encrypted index, inside the app's private container.
• Your encrypted keys, held in the system keychain and marked device-only, so they are not synced to iCloud or carried to another device by a backup.
• The sealed record for your recovery phrase, if you created one. The words themselves are never stored, which is why no screen can ever show them to you again.
• A count of failed unlock attempts, used to slow down guessing at the passcode screen.
• Your app preferences, such as theme, auto-lock delay and the shake gesture's settings, whether AlterVault Pro is active on this device, whether the app has already asked you for a rating, which version of the free limit this install was given, and the random identifier the usage events carry.

All of it is removed when you delete the app — permanently, since nothing is stored anywhere else. See the Terms for what that means for your data.

What we do not collect

• Your name, email address, phone number or any account credentials — AlterVault has no accounts.
• Your photos, videos, documents, file names, dates or thumbnails, in any form.
• Your passcode, your recovery phrase, or anything derived from either.
• Your location.
• Screen recordings, session replays, your taps or keystrokes, or any advertising identifier. The usage events in section 8 are the whole of what is collected about how you use the app, and none of them is linked to you.
• Your payment card details, which are handled entirely by Apple.

Third-party services

Four: the store and RevenueCat for the optional purchase, PostHog for the anonymous usage events, and Discord for feedback you choose to send:

There is no advertising network, no separate crash-reporting service and no tracking pixel anywhere in the app.

Checking this for yourself

None of the above has to be taken on trust. Point any network proxy at a device running AlterVault and use the app normally: you will see small batches of events going to PostHog, a purchase check with RevenueCat when you reach the upgrade screen, Settings or Restore Purchases, and one request to Discord if you send feedback — and nothing else. The events are plain JSON, so you can read exactly what they carry.

The store privacy labels

Apple's label for AlterVault declares Purchases and an anonymous User ID (the receipt check), Customer Support (feedback you send), Product Interaction, Crash Data and Performance Data (the usage events in section 8), and Advertising Data (which ad led to an install). Every one is declared as not linked to your identity and not used for tracking. Google Play's Data safety section says the same things in its own categories. No other category is declared, because no other category is collected.

Children's privacy

AlterVault is not directed at children under 13 years of age. We do not knowingly collect information from children, and in practice the app collects nothing that could identify anyone of any age.

Data deletion

Because AlterVault has no accounts and no cloud storage, there is nothing of yours in our systems to delete. Everything the app stores is on your device and is removed when you delete the app.

The usage events are tied to a random identifier that lives inside the app, so deleting the app ends the connection between you and any of them. If you bought AlterVault Pro, RevenueCat holds an anonymous record of that purchase. It carries no name, email or device identifier, so there is nothing in it that identifies you — if you would like it removed anyway, email us and we will request its deletion. Apple keeps its own record of the transaction under its own policy and tax obligations, which we cannot delete on your behalf.

Changes to this policy

If we make material changes we will update the "Last updated" date at the top of this page and, where appropriate, note the change in the app's release notes.

Contact

AlterVault is a product of Devaprime LLC. Questions or concerns about this policy: hello@altersend.com

AlterSend, our file transfer app, has its own policy at altersend.com/privacy. Nothing in this policy applies to it, and nothing in that one applies to AlterVault.