Vault Max

What Vault Max collects

Nothing. We do not receive your photos, videos, notes, files, passcodes, break-in photos, settings, device identifiers or usage information, and we have no way to receive them: the app includes no analytics or crash-reporting library and contacts no server of ours. There is no account to create and no sign-in.

Network connections

Vault Max makes one kind of network connection. When you buy or restore the Lifetime Unlock, Apple's StoreKit framework talks to the App Store under Apple's own privacy terms. Apple handles the payment and tells the app only whether the purchase exists for your Apple Account; we run no server and do not learn who bought it. The app remembers the answer on the device so it knows your plan when it is offline.

Apart from that, the app makes no network connections. It does not fetch content, check for updates, send diagnostics or load anything from the web.

If you have chosen to share analytics with app developers in your device's settings, Apple may provide us with crash reports and aggregated usage statistics in a form that does not personally identify you, under Apple's privacy policy. That is an Apple setting, not something the app adds.

Permissions and why they are asked

Every permission is optional. iOS asks the first time you use the feature that needs it, and the rest of the app works without it. These are the only permissions the app can ask for:

• Camera, to capture photos and videos with the private camera straight into your vault, and, only if you turn on Break-In Alerts, to take a front-camera photo of whoever enters a wrong passcode. Break-In Alerts is off until you switch it on.
• Microphone, to record sound when you capture a video with the private camera.
• Face ID or Touch ID, to unlock your vault without typing the passcode. The biometric check is done by iOS on the device; the app never sees your face or fingerprint data, only whether the check passed.
• Photos, add only, to save an item you choose to export back into your Photos library. Importing never needs this: the Photos option uses Apple's system picker, which hands the app only the items you select.
• Photos, to delete the originals of photos you have moved into the vault, and only when you accept that offer after an import. The offer itself is a switch in Settings.

Where your data lives

Everything you put in Vault Max is stored in the app's own container on your device. Every file, thumbnail, note and the vault's index are encrypted with AES-256-GCM, each file under its own key. Those keys are derived from your passcode together with a random secret kept in the device's Keychain, so a copy of the app's files on its own, without the passcode and the device, cannot be opened.

Your vault's files are included in your normal iPhone backup (iCloud or a computer) in their encrypted form unless you switch Include in iPhone backups off in Settings. Apple handles those backups under its terms; your passcode is still needed to open the vault after a restore.

Settings has Erase everything, which deletes every vault from the device. Deleting the app removes its container and everything in it.

Backup files you make

Encrypted backup in Settings writes one .vaultmax file containing your main vault and your other vaults, sealed with a separate backup password you choose. You decide where to keep it, for example in iCloud Drive, on a USB drive or on a Mac. Whoever stores that file for you holds only ciphertext and handles the file under their own terms; it cannot be opened without the backup password, by them or by us.

The share extension

When you choose Vault Max in another app's share sheet, the item is encrypted immediately on the device and placed in an inbox that only your main vault can open, the next time you unlock. The extension holds no key material: it can deposit, but it cannot open a vault or read what it saved. Nothing it handles leaves the device.

Break-in photos

If you turn on Break-In Alerts, the app takes a silent front-camera photo after repeated wrong passcodes, encrypts it to your main vault and shows it only there, with the time, the number of attempts and the code that was tried. These photos stay on the device, are never sent anywhere, and you can delete them at any time.

Passcodes and recovery

We cannot reset your passcode or open your vault, because no copy of your keys exists anywhere but on your device. If you forget your passcode and have no backup, the contents of the vault cannot be recovered by anyone, including us. That is by design.

Third parties

The app contains no third-party software development kits and no advertising. Apple, as the operator of the App Store and of iOS, is the only other party involved: it processes your purchase, your device backups and, if you enable them, Face ID or Touch ID, under Apple's privacy policy. We do not sell, share or receive personal information.

Children

Vault Max is a general-purpose utility and is not directed at children. The App Store rates it 4+ for its content. Because the app collects nothing, it collects nothing from children either; if you believe a child has used it in a way that concerns you, write to us at the address below.

Changes to this policy

If the app's behaviour changes in a way that affects this policy, we will post the new text on this page and update the date at the top. The policy applies to the version of the app current at that date.

Contact

Questions about this policy or the app: madmaxlabsllc@gmail.com, with Vault Max in the subject line. Support is at vaultmax.madmaxlabs.com/help.