Privacy Policy
Last updated 6 October 2026
Kryptra keeps your vault content on your device. This policy describes that private content separately from the limited purchase, usage and diagnostic information processed to operate and improve the app.
The short version
- There is no account. Kryptra never asks for your name, email or phone number.
- Alexarix Limited operates no server that receives your vault content. We could not read your files if we wanted to.
- Your unlock pattern, your recovery phrase and your encryption keys never leave your device in any form, encrypted or otherwise.
- We do not sell your personal data or show third-party advertisements inside the app. We collect limited subscription-screen events and technical information, described below; we do not collect your private vault activity or content through these events.
What stays on your device
All of the following is stored only in Kryptra's private container on your device, encrypted with AES-256-GCM:
- Photos, videos, files and their thumbnails.
- The index describing them — names, dates, sizes, and any EXIF metadata that came with a photo.
- Your vault keys, wrapped by a key derived from your unlock pattern and the device's Secure Enclave.
- Your recovery envelope, which only your nine-word phrase can open.
Your pattern itself is never stored — not as text, not as a hash that could be tested off the device.
The device Keychain separately stores the lifetime number of free photo/file and video imports. These counters contain no file names, content or vault identifiers and are not sent to our servers.
What leaves your device
Cloud backup and device transfer
Kryptra does not provide cloud backup or vault transfer in the current version. The app does not upload your vault content to CloudKit. Your recovery phrase can reset the unlock pattern for an existing vault on the device holding its files; it is not a backup and cannot restore files that are missing from that device. The current policy makes no promise about future backup features or their implementation.
Purchases
Payment is processed entirely by Apple; we never see your card or your Apple Account. To know whether your subscription is active we use Adapty (Adapty Tech Inc.), which receives a pseudonymous profile identifier generated on your device, the product you bought, purchase and renewal events, and your App Store country. It receives nothing about your vault. See Adapty's privacy policy.
Usage, subscription screens and installation attribution
The app sends a randomly generated installation identifier, app version and build, device model and operating-system version to our first-party Attribution System. The identifier is separate from your vault keys and vault identifiers. We use it to associate technical reports, subscription-screen interactions and purchase outcomes with an installation.
Events can include opening and completing the initial setup and the numbered screens shown within it, without the unlock pattern, recovery phrase or security-validation details. They can also include opening or closing a subscription screen, moving between its screens, starting, cancelling or completing a purchase, and technical failures. They include the subscription-screen placement and flow, a general reason for showing it (for example, a free limit or a paid feature), product identifier, price, currency and trial status where applicable. They never include your files, file names, album names, item counts, unlock pattern, recovery phrase, encryption keys or biometric results.
Our servers also process network request information, including IP addresses and their hashed or subnet forms, approximate country, network provider (ASN) and User-Agent. This is used for service security, diagnostics, and measuring installations and campaign performance. Installation and purchase records may be associated with campaign and click records. Where a campaign is configured, conversion information can be sent to its measurement provider. Adapty can send us subscription and purchase events through server-to-server webhooks.
This limited collection is enabled as part of operating the app; it does not require an account. The app does not request the advertising identifier (IDFA). Your camera, microphone, photo-library and biometric permissions remain controlled by iOS and are used only for the features described below.
Firebase product analytics
When configured, Google Firebase Analytics receives general app usage, device and app information, an analytics installation identifier, and allowlisted outcomes of initial setup, imports and deletion. Import source and a general success, partial, blocked or failure result may be included. Files, filenames, album names, vault item identifiers and counts, unlock patterns, recovery phrases, encryption keys and biometric results are excluded. We use these events to improve reliability and understand whether core actions complete. Analytics events may also appear as generic breadcrumbs in Crashlytics. See Firebase's privacy information.
Hosting and support
Cloudflare hosts our public site and first-party API infrastructure and processes network requests to provide and secure those services. See Cloudflare's privacy policy. If you email support, we receive your email address and the information you choose to provide. Never send us vault files, your unlock pattern, recovery phrase or encryption keys.
Crash reports
When crash reporting is configured, Firebase Crashlytics (Google) receives technical diagnostics such as crash stack traces, device and operating-system information, app version and crash-reporting installation identifiers. Kryptra does not intentionally attach vault content, file names, patterns or keys as custom values or log messages. Technical reports can contain execution context; a crash reporter operating in the app process is not a guarantee that a particular code path cannot appear in a report. See Firebase's privacy information.
Permissions and why
| Permission | Used for |
|---|---|
| Camera | Shooting photos and video directly into the vault. Nothing is added to your photo library. |
| Microphone | Recording audio while you film inside the vault. |
| Photo library (read) | Letting you choose items to move into the vault. |
| Photo library (change) | Asked for only if you tell Kryptra to remove the originals after an import, and only at that moment. Deleted originals go to the system's Recently Deleted album for 30 days, and with iCloud Photos on the deletion reaches your other devices. |
| Face ID / Touch ID | Optional quick unlock. The biometric check happens on the device; we receive nothing. |
What we never receive
- Files, thumbnails, file names or any vault metadata.
- Your unlock pattern or your recovery phrase.
- Any encryption key, in any form.
- How much you keep in the vault, or what any of it is.
Retention and deletion
Your vault content stays on the device. Erase everything in Settings removes the vault files and keys. Cloud backup is not available in the current version. Removing vault content or uninstalling the app does not automatically delete server-side analytics or purchase records, and does not cancel a subscription. Separate device Keychain records for the installation identifier and lifetime free-import counters are retained when vaults are erased and can survive reinstallation on the same device.
We retain limited first-party usage, attribution, purchase and support records as needed for the purposes described here and applicable legal obligations. We do not currently promise a fixed automatic deletion period for those records. Contact us to request access or deletion; we may need information sufficient to locate your installation or purchase records, but never your vault keys or recovery phrase. Apple and Adapty retain purchase data under their own rules. Firebase states that Crashlytics retains crash data and associated installation identifiers for 90 days before starting removal from live and backup systems.
Your rights
Where applicable data-protection law grants them, you may request access, correction, deletion or a copy of your personal data, and object to or request restrictions on processing. Write to support@alexarix.com. Our limited installation and purchase identifiers are pseudonymous, not a promise that all records are anonymous. You may also contact the relevant data-protection authority. We handle requests under applicable law and may retain records that we are legally required to keep.
Processing locations
Our infrastructure and service providers may process limited technical, support and purchase information outside your country. This does not upload your vault content. Provider-specific privacy and transfer information is available through the links above.
Children
Kryptra is not designed specifically for children. We do not verify users' ages, so the limited technical and purchase processing described above can occur without us knowing a user's age. If you believe information relating to a child has been collected, contact support@alexarix.com to request deletion under applicable law.
Changes
We update this page and its date when our practices change, and provide any additional notice required by applicable law. The Privacy link in the app opens the current policy.
Contact
Alexarix Limited — support@alexarix.com