Nothing of yours leaves your device.

What we collect

No personal data, and none of your content. Kinship Vault does not run analytics, telemetry, crash reporting, advertising SDKs, or any third-party data collection of any kind. If you never use cross-platform sync, nothing about you reaches any server we run. If you do, the relay keeps only the technical records listed under Cross-platform sync and sharing.

Specifically, we do not collect:

• Your name, email, phone number, or any personally identifying information
• Your documents, photos, or any content you store in the vault
• Your decryption keys, recovery passphrase, or PINs
• Usage analytics, app interaction events, or session data
• Crash logs or diagnostic reports
• Device identifiers, advertising IDs, or location data
• Contacts, calendar entries, or any data outside the app

What stays on your device

Your keys never leave your devices in a form anyone else can use, and your vault is only ever decrypted on your devices:

• Documents and metadata. Encrypted with AES-256-GCM, with per-document keys derived from a master key.
• Master key. Wrapped by your device's secure hardware; cannot be extracted in plaintext. On iPhone, iPad, and Apple silicon Mac this is the Secure Enclave; on Android it is the Android Keystore, hardware-backed on devices that have a secure element. On macOS, because many Macs have no Touch ID, the app additionally stores a copy wrapped by a key derived from your PIN (PBKDF2-HMAC-SHA256, 200,000 iterations) so that the PIN alone can unlock the vault on that machine. Every copy stays in your device's keychain or keystore and is never transmitted.
• Recovery passphrase. Generated on your device for you to write down. Never transmitted.
• Recovery shards. When you split your recovery key for trusted contacts, the shards are generated on your device and shared via QR codes, files, or printable PDF cards through the system share sheet. The shards never pass through any Kinship Vault server.
• PINs and panic codes. Stored only as cryptographic hashes on your device.
• Audit log. A hash-chained record of vault access, stored locally and never transmitted.

Optional cloud backup

If you enable iCloud backup, the app writes an encrypted .kvbackup file to your personal iCloud Drive container. The file is encrypted on your device with a key derived from your master key before it leaves the device, so Apple sees only encrypted bytes. Your decryption key is never uploaded to iCloud.

On Android, the same optional, user-initiated backup writes an encrypted file to your own Google Drive (a private app folder). It is likewise encrypted on the device before upload, so Google sees only encrypted bytes and your key is never uploaded.

This feature is governed by Apple's or Google's terms and privacy policy for the cloud you use. Kinship Vault does not have access to your iCloud or Google account, or any data stored within it.

Sync between your devices

Your iPhone, iPad and Mac sync your vaults with each other through your own iCloud account (CloudKit), and your Android devices sync with each other through your own Google Drive. Shared vaults between Apple devices use iCloud sharing. In every case, items are encrypted on your device before upload, so Apple and Google store only ciphertext. When you link a second device on the same platform, the vault key passes directly from one screen to the other device's camera in a QR code; it is never sent over the network. When you share a vault with someone, its key is sealed to their device's public key. On iPhone, iPad and Mac, the keys of your additional vaults are also kept in your iCloud in an encrypted file that only your main vault's key can open, so that restoring your main vault on a new device, for example with your recovery passphrase, brings the others back.

Cross-platform sync and sharing

To link Apple and Android devices to the same vaults, or to share a vault with someone on the other platform, Kinship Vault uses an end-to-end encrypted relay that we operate on Supabase. It only bridges the two ecosystems; your Apple devices keep syncing with each other through iCloud, and your Android devices through Google Drive. Nothing contacts the relay until you create or join a vault that syncs across platforms.

What the relay stores:

• Encrypted records. Your items, encrypted on your device with AES-256-GCM, with no label saying what kind of item each one is. We cannot decrypt them.
• Sealed keys and public keys. Each device's public keys, and vault keys sealed to a device's public key. Device private keys never leave the device, and no key your recovery passphrase could unlock is stored.
• An anonymous account per device. Sign-in to the relay is anonymous: no email, no phone number, no Apple or Google account.
• Device records. For each device: its platform (Apple or Android), app protocol version, when it was added and when it last synced, and which vaults it belongs to and since when. A device's name is sealed so only the vault's owners can read it.
• Invitations and join requests. Invite secrets are stored only as one-way hashes. Join requests are kept for 7 days.
• App integrity checks. To keep abuse off the service, a device proves it is running a genuine copy of the app, using Apple App Attest or Google Play Integrity. We keep the attestation public key and the result.

Network data. Like any internet service, the relay sees the IP address a request comes from. We use it to limit abuse (rate limiting), not to identify you or build a profile.

How long it is kept. Records of a person or device removed from a vault are deleted after 30 days. A vault you delete is erased after a 72-hour delay. A vault left with no owner is erased after 90 days. To have the relay's records about your devices deleted sooner, remove the devices from your vaults, or email us and we will delete them.

Strict Offline. With Strict Offline on, your personal vaults stop syncing through the relay until you resume. Shared vaults keep syncing, because the other members depend on them.

Permissions we request

• Camera. On iPhone, iPad, and Android, used to scan documents. On Mac, used only to read the pairing QR code from another device, as the Mac has no document-scanning flow. Image processing happens entirely on your device. No images are transmitted.
• Biometrics (Face ID, Touch ID, or Android fingerprint/face). Used to unlock the vault and authorize sensitive actions. On a Mac without Touch ID, your Mac login password or your app PIN is used instead; on Android, a PIN is the fallback. Biometric data is handled by the operating system (iOS, macOS, or Android) and is never accessible to Kinship Vault.
• Notifications. Used only for local document expiry reminders. No push notifications come from any server.

Third-party services

Kinship Vault uses no third-party analytics, advertising, or data-sharing services. The only third-party services involved in distributing or operating the app are:

• Apple App Store and Mac App Store. For distribution and subscription billing on Apple devices. Apple's privacy policy applies to your purchase.
• Google Play. For distribution and subscription billing on Android. Google's privacy policy applies to your purchase.
• Apple iCloud or Google Drive. For encrypted sync between your own devices and for encrypted backup (iCloud on Apple devices, your own Google Drive on Android). Both store only ciphertext.
• Supabase. Hosts the encrypted relay used only for cross-platform sync and sharing. It stores the records described above, never readable content or usable keys.
• Apple App Attest and Google Play Integrity. Used only when you use cross-platform sync, to confirm the relay is talking to a genuine copy of the app.

Subscriptions and payments

Subscriptions are processed entirely by Apple through StoreKit on Apple devices, and by Google through Google Play Billing on Android. Kinship Vault does not see, process, or store your payment information. We receive only a non-identifying signal that your subscription is active or inactive.

To manage or cancel your subscription on an iPhone or iPad, open the Settings app, tap your name, then Subscriptions. On a Mac, open the App Store app, click your name in the bottom-left corner, then Account Settings, then Manage next to Subscriptions. On Apple devices this is a single universal purchase, so one subscription covers all of them.

On Android, open the Google Play Store app, tap your profile icon, then Payments & subscriptions, then Subscriptions. The Android purchase is separate from any Apple purchase.

Children

Kinship Vault is not directed at children under 13 and we do not knowingly collect data from anyone, including children. The app's age rating is 4+ because it contains no objectionable content, but the product is intended for adult use (managing personal documents, legacy planning, and similar).

International users

We do not collect personal data, so no personal data is transferred across borders to us. If you use cross-platform sync, the relay stores encrypted records and the technical device records described above, which may be processed outside your country by our hosting provider. iCloud and Google Drive transfers are governed by Apple's and Google's regional data handling, not ours.

Your rights under GDPR, CCPA, PIPEDA, and similar laws

Most data-protection laws give you rights to access, correct, delete, or port your personal data held by a service. Kinship Vault holds none of your content in readable form, and no name, email or phone number. If you use cross-platform sync, you can ask us for, or ask us to delete, the relay's records about your devices by emailing us.

You can delete all Kinship Vault data on a device at any time by deleting the app. Encrypted copies in your own iCloud or Google Drive are removed through Apple's or Google's settings; relay records follow the retention above, or are deleted on request.

Changes to this policy

If we change this policy in any material way, we will update the "Last updated" date at the top and notify users via the app and via this page. Past versions will be available on request.

Contact

Questions about this policy? Email support@kinshipvault.app.