VaultLoom-Privacy-Policy

VaultLoom Privacy Policy

Effective date: 23 September 2026

VaultLoom is a privacy-focused, local-first application designed to help users securely store and manage personal information, including passwords, notes, contacts, images, videos, assets, messages, and encrypted backups.

This Privacy Policy explains what information VaultLoom processes, how information is stored, when information may leave your device, and the choices available to you.

1. Local-first storage

VaultLoom is designed to store your vault information locally on your device by default.

Information stored locally may include:

• passwords and account information
• notes
• saved contacts
• images
• videos
• asset information
• saved messages
• application preferences
• encrypted backup information

VaultLoom does not automatically upload this information to a remote server.

Your locally stored information remains on your device unless you choose to use a feature that requires network communication, such as private messaging, cloud-based sharing, or encrypted backup sharing.

2. Vault password and authentication

VaultLoom allows you to protect access to the application using a Vault password and supported biometric authentication.

Vault passwords are not stored in readable plain text.

VaultLoom may use the device’s secure storage facilities to store security-related information required for authentication.

If biometric authentication is enabled, biometric verification is handled by your device’s operating system.

VaultLoom does not receive, collect, store, or transmit your fingerprint, face template, or other biometric data.

3. Reinstallation and password setup

VaultLoom is designed so that uninstalling and reinstalling the application requires the user to complete Vault password setup again.

VaultLoom does not provide password recovery for locally encrypted information where the required password or encryption key has been lost.

Users are responsible for securely retaining any passwords or encryption keys required to access encrypted data or backups.

4. Encryption

VaultLoom uses encryption to protect sensitive information.

Depending on the feature and configuration, VaultLoom may use authenticated encryption methods including:

• AES-256-GCM
• ChaCha20-Poly1305
• layered encryption using both algorithms

Encryption keys are intended to remain under the user’s control.

Where VaultLoom sends encrypted information through a relay or cloud service, the service is not intended to receive the user’s decryption key unless the user deliberately shares that key with another person.

Anyone who obtains a valid decryption key may be able to decrypt the associated information.

5. Private messaging

VaultLoom includes optional private messaging functionality.

Private messaging may transmit encrypted information over the internet, including:

• encrypted messages
• encrypted room information
• encrypted images
• encrypted videos
• encrypted profile information associated with a room

VaultLoom’s relay infrastructure may process technical information necessary to provide messaging functionality, including:

• room identifiers
• VaultLoom user identifiers
• timestamps
• encrypted message payloads
• encrypted media
• connection information
• membership information
• technical request information such as IP addresses that may be processed automatically by hosting infrastructure

Private-room decryption keys are not intended to be automatically transmitted to VaultLoom’s relay.

A user may intentionally share a room ID and decryption key with another person using VaultLoom’s sharing features. In that case, the information is shared at the user’s direction.

6. VaultLoom User ID

VaultLoom may generate a unique VaultLoom User ID.

This identifier may be used for features such as:

• identifying a user for encrypted backup sharing
• receiving shared encrypted backups
• private communication features
• QR-code based sharing

The VaultLoom User ID is not intended to reveal the user’s real-world identity.

Users should avoid including sensitive personal information in display names unless they choose to do so.

7. Display names

VaultLoom may allow users to choose a display name.

A display name does not need to be the user’s real name.

A display name may be visible to other participants in a private messaging room.

Users are responsible for choosing what information they include in their display name.

8. Contacts

VaultLoom may allow users to select or import contacts from their device.

Contact information may include:

• contact names
• phone numbers
• email addresses
• other information selected from the device contact record

Contact information imported into VaultLoom is intended to be stored locally unless the user explicitly chooses to include that information in an encrypted backup or another sharing feature.

VaultLoom does not sell contact information.

9. Camera, photos and videos

VaultLoom may request access to the camera or media selection features of your device.

These may be used to:

• capture images
• record videos
• import images or videos
• scan VaultLoom QR codes
• attach encrypted media to private messages

VaultLoom does not automatically upload your entire photo or video library.

Only media selected or created by the user for a particular VaultLoom feature is processed.

10. Encrypted backups

VaultLoom may allow users to create encrypted backup files.

Backup data is encrypted using a password or encryption key chosen or stored at the user’s direction.

If a user chooses to share or upload a backup, an encrypted version of that backup may be transmitted to cloud infrastructure.

VaultLoom cannot guarantee recovery of a backup if the user loses the required decryption key or password.

11. Shared backups

VaultLoom may allow encrypted backups to be shared with another VaultLoom user using a VaultLoom User ID or QR code.

The recipient must have the required backup decryption key or password to access the encrypted contents.

Users should only share backup passwords or encryption keys with people they trust.

12. Cloud and relay infrastructure

VaultLoom may use third-party infrastructure providers to operate optional online features.

At the time of this policy, VaultLoom may use Cloudflare services, including:

• Cloudflare Workers
• Durable Objects
• R2 object storage

These services may process encrypted data and technical information required to deliver the service.

Cloudflare may independently process network information in accordance with its own privacy policies.

VaultLoom is designed so that cloud infrastructure receives encrypted content wherever practical rather than readable vault content.

13. Data collected by VaultLoom services

Depending on which online features you use, VaultLoom’s infrastructure may process:

• VaultLoom User ID
• room IDs
• room membership identifiers
• access tokens
• timestamps
• encrypted messages
• encrypted media
• encrypted backup files
• technical connection information
• service request logs

VaultLoom does not use this information for advertising.

VaultLoom does not sell personal information.

14. Information not intentionally collected

VaultLoom does not intentionally collect:

• biometric templates
• fingerprint data
• face recognition templates
• precise GPS location
• advertising identifiers for targeted advertising
• browsing history outside VaultLoom
• financial account credentials for advertising or profiling purposes

15. Data sharing

VaultLoom does not sell user data to advertisers or data brokers.

Information may be shared only where necessary to:

• provide a feature requested by the user
• deliver encrypted content to another VaultLoom user
• operate necessary hosting infrastructure
• comply with applicable law or a valid legal requirement
• investigate security abuse or misuse of the service

Third-party hosting providers may process limited technical information as required to provide their services.

16. Data retention

Locally stored VaultLoom data remains on the user’s device until the user deletes it, clears app storage, or uninstalls the application.

Online data may be retained only for as long as necessary to provide the relevant service.

Private messaging rooms may be automatically deleted after approximately 30 days of inactivity, depending on the current service implementation.

Encrypted backup files may remain stored until:

• the user deletes them
• the recipient removes them
• the storage period expires
• VaultLoom removes them in accordance with service maintenance or retention rules

17. Deleting your information

Users can delete locally stored information directly within VaultLoom.

Users may also uninstall VaultLoom to remove locally stored application data from the device, subject to the device operating system’s behaviour.

Where VaultLoom stores server-side information associated with a VaultLoom User ID, users may request deletion of that information.

Deletion requests can be submitted using:

Email: [YOUR SUPPORT EMAIL]

Future versions of VaultLoom may also provide an in-app account or VaultLoom identity deletion option.

18. Security

VaultLoom uses technical measures designed to protect user information, including encryption and device-secure storage.

However, no software, device, encryption system, cloud service, or communication method can be guaranteed to be completely secure.

Users are responsible for:

• protecting their Vault password
• protecting encryption keys
• protecting room decryption keys
• protecting backup passwords
• securing access to their device
• only sharing sensitive information with trusted recipients

19. User-generated content

VaultLoom private messaging allows users to communicate with other users.

Users are responsible for the content they create, transmit, or share.

VaultLoom may provide features for blocking, reporting, leaving, or deleting communication rooms.

Where a user deliberately reports content, information necessary to review that report may be transmitted to VaultLoom.

20. Children’s privacy

VaultLoom is not intended for children under the minimum age required by applicable law or by the relevant app store.

VaultLoom does not knowingly collect personal information from children for advertising or profiling.

If you believe a child has provided personal information through VaultLoom contrary to applicable law, contact us at:

[YOUR SUPPORT EMAIL]

21. International processing

Online VaultLoom features may use infrastructure located in countries other than the user’s country.

As a result, encrypted data and technical information may be processed or stored internationally.

22. Changes to this Privacy Policy

This Privacy Policy may be updated when VaultLoom’s functionality, infrastructure, legal requirements, or privacy practices change.

When material changes are made, the effective date at the top of this policy will be updated.

Users are encouraged to review this Privacy Policy periodically.

23. Contact

For privacy questions, support requests, or data deletion requests, contact:

Developer: RDSoft
Application: VaultLoom
Email: support@rd-soft.net
Country: Australia