No VaultBolt account
VaultBolt works without a login, email address or phone number. App Store purchases are handled by Apple under Apple's terms and privacy policy.
Your vault content
Photos, videos, files and vault metadata are encrypted on your device. VaultBolt does not receive readable vault content or the keys that decrypt it.
Encrypted backup
Encrypted backup is stored in your private iCloud database. Apple can see that encrypted records exist and their size; it does not receive the keys.
Sharing
When you share items, they are encrypted on your iPhone and stored as ciphertext in VaultBolt's iCloud public database. The key travels only in the part of the link after #, which browsers never send to a server, or in a separate 6-word phrase. Nobody can open a share without it, including Apple and us. Expired and revoked shares are deleted.
Silent duress alert (optional)
If you set up a silent alert, VaultBolt registers your trusted contact with our alert service (alerts.vaultbolt.app). We email them once to ask if they agree, and nothing else is sent unless they do. We store their email address and your note encrypted under a key that only your phone and their confirmation link hold, so we can't read them at rest. If you enter your duress code, the alert is emailed with your note and, only if you turned it on, an approximate area rounded to about 1 km. Your contact can stop alerts and block their address from every email. Unconfirmed requests are deleted after 14 days; confirmed contacts are kept until you remove them or they stop alerts. The service is hosted on Cloudflare and emails are delivered by Brevo. We keep no logs of alerts.
Device check
To stop abuse of the alert service, the app proves it is genuine with Apple's App Attest. This uses a key created on your device; it doesn't identify you or your Apple Account.
Analytics
VaultBolt 1.0 has no analytics, advertising identifiers or crash reporting. If that ever changes, it will be off until you opt in and will never include file names, vault counts, which unlock was used, screenshots or duress activity.
This website
This site is static. It sets no cookies and loads no third-party trackers or ads. The demo vault runs entirely in your browser with fictional sample photos and saves nothing. Our host, Cloudflare, processes standard request logs to serve and protect the site.
Changes and questions
We will update this page before any change to how data is handled. For questions, use the Support page.
