Privacy Policy
CTRL Vault has no server and no account. Your photos are encrypted on your iPhone, and the only copy that leaves it goes, still encrypted, to your own iCloud. We can’t see them, and we don’t collect anything about you.
Who we are
Mario Noriega, an individual established in Guatemala City, Guatemala, trading as CTRL Vault (“CTRL Vault”, “we”), makes the CTRL Vault app and the vault.ctrllog.app website and decides how your information is used. Contact: [email protected], or 41 Avenida 15-49, Zona 5, Jardines de la Asunción Sur, Guatemala City, Guatemala.
What we collect
Nothing. No analytics, no advertising, no crash-reporting code and no sign-in. We can’t see your photos, your pattern, your recovery phrase or how you use the app.
Your photos and videos
When you add a photo or video, CTRL Vault encrypts it on your iPhone with AES-256-GCM before storing it. Only the photos you pick are read. The app can’t see the rest of your library unless you turn on deleting originals after import, which needs access to your library to remove them. If you ask CTRL Vault to delete the originals from Photos after import, it asks iOS for permission first, and iOS confirms with you.
Vault files are kept out of your iPhone’s own iCloud and computer backups, so the only backup is the encrypted one described below.
Your pattern and recovery phrase
Your pattern is turned into a key on the iPhone and never leaves it. It is never stored as a pattern and never uploaded.
Your 12-word recovery phrase is shown once, when you create a vault. CTRL Vault doesn’t keep a readable copy, so it can’t show it to you again, and neither can we. Write it on paper.
Encrypted iCloud backup
Backup is on by default and is free. Your vault is encrypted on the iPhone first, and then the encrypted files go to CTRL Vault’s folder in your own iCloud. The backup can only be opened with your recovery phrase, never with your pattern alone. Apple stores the files but can’t read them, and we never receive them or your iCloud login. Apple’s iCloud terms and privacy policy cover that storage. You can turn backup off in the app.
Export
You can export a vault at any time, paid or not. The export stays encrypted, uses a documented format, and opens with your recovery phrase, even without the app. You choose where it goes through the iPhone share sheet.
Services involved
CTRL Vault has no analytics, advertising or crash-reporting code from anyone. The only outside services are:
- Apple sells CTRL Vault Pro, stores your encrypted backup in iCloud, and provides the photo picker. Apple’s privacy policy applies to those.
- Apple’s Share With App Developers. If you turned it on in iPhone Settings, Apple sends developers anonymous crash reports and usage numbers. You can turn it off in Settings › Privacy & Security › Analytics & Improvements.
- Cloudflare hosts this website (see below).
- iCloud Mail receives the emails you send us.
Purchases
CTRL Vault Pro is sold through the App Store. Apple handles the payment, and we never see your name, card or Apple Account. The app only asks Apple whether you have Pro.
If you email us
We get your email address and what you write, and use them only to answer you. Never send us your recovery phrase or photos: we don’t need them and will never ask. Ask us and we’ll delete the conversation.
This website
vault.ctrllog.app sets no cookies and runs no analytics or tracking pixels. Cloudflare, which serves the site, processes your IP address to deliver pages and block attacks, under Cloudflare’s privacy policy.
We don’t sell or share your data
We have none to sell. We don’t sell, rent or share personal information, and we don’t use it for advertising.
How long things are kept
Your vaults stay until you delete them. Deleting a vault removes it from this iPhone and from your iCloud backup. Deleting the app removes the vaults on this iPhone, but not the encrypted backup in your iCloud, so you can still restore with your phrase. Emails are kept while we help you, and deleted when you ask.
Your rights
Wherever you live, including under the GDPR in Europe and the CCPA in California, you can ask what we hold about you, have it corrected or deleted, and get a copy. Your photos are already in your hands: export or delete them in the app. For anything else, which can only be emails you sent us, write to [email protected]. You can also complain to your local data protection authority.
Children
CTRL Vault is not directed at children under 13, or under the minimum age for digital services in your country.
Changes and contact
If this policy changes, the new version will be posted here with a new date. Questions go to [email protected], or by post to Mario Noriega, 41 Avenida 15-49, Zona 5, Jardines de la Asunción Sur, Guatemala City, Guatemala.