Privacy Policy

1. Who is responsible

The controller (administrator) is the operator of the Privio app. This policy does not invent a company name. The only technical identity present in the app configuration is m-mlynarczyk87. The public version-check and policy host is https://static.priviomobile.app (Cloudflare).

Once Privio is published, the publisher name and any contact details shown on the Apple App Store and Google Play listings are the public identity of the operator. Until then, you can read this policy in the app (Settings → Privacy policy) and the related Legal screens.

Privio has no cloud account and no vendor mailbox that receives in-app reports. There is no email address configured in the app binary. Do not expect a reply from a server-side inbox that does not exist.

2. What Privio is

Privio is a local encrypted vault on your phone or tablet. It stores photos, videos, documents, notes, passwords, and other files that you add. There is no Privio cloud account and no vendor-operated sync. There is no crash-reporting SDK. Optional product analytics (PostHog, EU cloud) run only after you opt in in Settings.

Your files are protected by encryption.

File contents and thumbnails are encrypted on disk with AES via the operating-system crypto APIs used by Expo. The vault key is wrapped with your PIN (PBKDF2-SHA256, 100,000 iterations) and stored in the OS secure store (Keychain / EncryptedSharedPreferences). The PIN is not stored as ordinary text.

SQLite on the device holds vault metadata such as file names, types, sizes, folder names, favourite flags, and dates. That metadata is not encrypted at rest in the database. Note and password bodies are stored as encrypted files, not as plaintext in SQLite.

An optional second PIN unlocks a separate local vault on this device. Both vaults stay on the device. Privio does not send either vault to a server.

3. Purposes and legal bases (GDPR Art. 6 / Art. 13)

Providing the local vault (creating a PIN-protected store, encrypting and decrypting files you add, backup/restore you start, share-in, export/share of copies you choose, trash, and reset) is processing necessary to perform the contract for the service you request (Art. 6(1)(b) GDPR) and, where that framing does not apply, to take steps at your request before the contract.

The optional HTTPS version check (see section 5) is based on the operator’s legitimate interest (Art. 6(1)(f) GDPR) in telling you when this installed build is below a published minimum version. The app still opens if the check fails or the network is unavailable. The installed version is compared on the device; it is not sent as a query parameter.

Operating-system permissions (camera, photos/videos, microphone, Face ID / biometrics) are requested only when you use the related feature. The legal basis for accessing those OS interfaces is your consent, given or refused in the system dialog (Art. 6(1)(a) GDPR). You can withdraw OS permission in system settings; the vault on the device remains until you delete it.

Optional product analytics (see section 6) are sent only if you turn on Share anonymous usage analytics. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw consent in Settings; new events then stop. Previously sent anonymous events may remain with PostHog according to their retention.

Privio does not carry out profiling and does not make automated decisions that produce legal or similarly significant effects (Art. 22 GDPR).

4. Data stored on the device

On this device Privio may store: encrypted file bytes and thumbnails; SQLite metadata described above; PIN-wrapped keys and settings in the OS secure store; a cached copy of the last version manifest; your language preference; a record that you accepted a given version of the Terms and this policy; and, if you opt in to analytics, a consent flag plus a random installation UUID.

Clipboard: if you copy a password, Privio keeps it on the clipboard briefly and then tries to clear it. The system clipboard is shared with other apps while the text is there.

Temporary decrypted copies may be written while you preview, open, export, or share a file, then removed when that flow finishes. Sharing or exporting creates a decrypted copy that leaves Privio’s control once another app or folder receives it.

If you turn on the optional failed-PIN photo, Privio stores a camera image on this device after a wrong PIN.

5. Network: version check and PDF preview

Privio is not a cloud service. Expo Updates are disabled in the app configuration (no OTA update channel).

On launch, Privio may send a HTTPS GET request to https://static.priviomobile.app/ to download a small JSON version manifest. That request is ordinary HTTPS: the worker (and the network path, including Cloudflare) can see your IP address, User-Agent, and standard HTTP headers. Privio does not attach your vault, PIN, or file contents. The operator does not use this request to build advertising profiles.

When you preview a PDF, Privio may download the pdf.js library from cdnjs.cloudflare.com (Cloudflare CDN) and cache it on the device. The PDF file itself is rendered locally and is not uploaded. That GET is also ordinary HTTPS (IP address and User-Agent).

If you choose Backup to Google Drive, Privio opens Google sign-in in the system browser and then talks to Google Drive over HTTPS. Recipients of those requests are Google, not Privio. Only the encrypted .privio file is uploaded, and only after you start that flow.

Recipients of those technical requests are Cloudflare, Inc. (Cloudflare Workers and cdnjs). Cloudflare may process the request on servers outside your country. Where GDPR restricted transfers apply, Cloudflare publishes its own transfer mechanisms (including Standard Contractual Clauses) in its customer documentation. Privio does not sell this information and does not use it for tracking across apps or websites.

Other reads of local content:// or file URIs during import are not transmissions to Privio servers.

6. Optional product analytics (PostHog, EU)

By default Privio sends no analytics. If you turn on Settings → Share anonymous usage analytics, Privio sends anonymous product events (for example app opened, vault created, an item was added) to PostHog hosted in the EU at https://eu.i.posthog.com. The recipient is PostHog (PostHog Cloud EU). Legal basis: consent (Art. 6(1)(a) GDPR).

Events use a random installation UUID, not a login. They do not include PIN, passwords, file names, note bodies, photos, emails, EXIF, album names, file paths, or whether a vault is a decoy. Session recording and tap autocapture are off.

You can withdraw consent in Settings; new events then stop. Uninstalling the app removes the local consent flag and installation UUID. PostHog may retain previously received anonymous events according to its own retention.

7. Backups, sharing, and gallery originals

A vault backup is a password-protected .privio file that you save with the system Share sheet or into a folder you choose. Privio does not upload that local backup. The backup password is not stored on the phone. Your PIN is not written into the backup file. Anyone who later has that file and the password can open the vault contents.

If you choose Backup to Google Drive, Privio uploads only a user-initiated encrypted .privio file to a Privio folder on your Google Drive. Privio has no servers for that copy. Google then stores the ciphertext under your Google account.

You can share a file into Privio from other apps. You can export or share a decrypted copy of an item you choose. Those copies are user-initiated.

After you import from the gallery, Privio may offer to delete the gallery originals. That happens only if you confirm, and only for items you selected. Copies already in the vault stay in the vault.

8. Permissions

Camera: take a photo or video directly into the vault. If you enable the optional failed-PIN photo, the camera may also be used after a wrong PIN.

Microphone: record sound when you capture video into the vault.

Photos / videos (media library): import items you pick, and optionally delete gallery originals after import, only with your confirmation.

Face ID / biometrics: optional unlock of the vault using a key copy kept in the OS secure store. Biometric templates stay in the operating system; Privio does not receive fingerprint or face images.

9. Retention, trash, and deletion

Vault contents stay on the device until you delete them, empty trash, reset the vault, or uninstall the app (subject to how the OS removes app data).

Items you move to Trash are kept for 30 days, then permanently deleted from this device. You can restore them or delete them sooner.

Settings → Reset vault and Lock screen → Delete vault call the same local wipe (keys, encrypted files, and both local vaults). That is erasure of Privio’s copy on this device. It does not delete backups, shared copies, or gallery files that you left outside the app.

The version-manifest cache, legal-acceptance flag, and analytics consent / installation UUID stay in the OS secure store until overwritten, wiped by uninstall, or (for the cache) replaced by a later check.

10. Device backups (Android and iOS)

Android Auto Backup of the app is disabled in the app configuration (allowBackup = false), so Google Drive app backups of Privio data are not requested. The Expo SecureStore plugin is left at configureAndroidBackup: true so that, if Auto Backup were ever enabled, SecureStore entries would still be excluded. Setting that plugin flag to false would remove Expo’s SecureStore exclusion and is not used.

On iOS, Keychain items are stored with accessibility This Device Only and are not synced through iCloud Keychain by Privio. Encrypted files and the SQLite database live in the app sandbox; if you back up the whole device (Finder, iCloud device backup), those files may be included in that device backup. You can turn off device backups in system settings. This is OS backup behaviour, not a Privio cloud.

11. Your rights

Because vault contents are on your device and not in a Privio account, the practical way to exercise GDPR rights of access, erasure, and portability is in the app: browse and export items; create a .privio backup; permanently delete items or reset the vault.

You may also object to the version-check request by using the app offline; a failed check does not block the vault. You may withdraw OS permission in system settings. You may withdraw analytics consent in Settings → Share anonymous usage analytics.

You can complain to your supervisory authority (in Poland: Prezes Urzędu Ochrony Danych Osobowych). This policy is information under Art. 13 GDPR. It is not legal advice.

12. Children

Privio is a general-purpose local vault. It is not directed at children and does not knowingly collect personal data from children in a cloud account, because it does not operate such an account.

13. Changes

If this policy changes in a way that needs a new in-app acknowledgement, Privio will store a new acceptance version and ask you to accept again before creating or restoring a vault. The in-app screens remain the copy you can read without a network connection.