Effective date: October 24, 2026

This policy explains what the GPG Vault iOS app ("GPG Vault", "the app") does with your information. GPG Vault is made by PE Mykyta Pustovoit, a private entrepreneur registered in Ukraine.

The short version

GPG Vault doesn't collect any data. The app makes no network requests, has no accounts, and contains no analytics, ads, tracking or crash reporting. Your keys, messages and notes stay on your iPhone, and we can't see any of them.

What stays on your device

• Your keys are stored in the iPhone's Keychain. A key protected by a passphrase stays encrypted with that passphrase.
• Your passcode and duress code are never stored. The app keeps only a salted hash of each one in the Keychain, on this device only.
• Key notes are stored in a database on your iPhone.
• Settings are stored in the app's local preferences on your iPhone.
• Messages you encrypt, decrypt, sign or verify are processed on your iPhone and never sent anywhere by the app.

iCloud Keychain and backups

Both are off by default. If you turn on iCloud Keychain sync or backups in the app, your keys, including secret keys, are stored in your iCloud account or your iPhone's backups. Apple handles that data under Apple's Privacy Policy, and we don't have access to it. Your passcode, duress code and key notes are never synced or backed up.

Face ID

If you unlock the app with Face ID, iOS checks your face on the device. GPG Vault only learns whether the check passed and never receives face data.

Exported keys

When you export a key through the share sheet or Files, it goes only where you send it.

Sharing

We don't sell or share your data with anyone, because we never receive it.

Deleting your data

You can delete any key from its menu, which also deletes its notes. A duress code can be set to erase all your keys. Data you chose to sync to iCloud Keychain or include in backups is managed in your iCloud settings.