1. Who we are & scope
This policy covers Revault’s website, web application, and native iOS and Android apps. “We” refers to the operator identified below. Apple, Google, payment providers, and storage services you choose also process information under their own policies.
Kehtra (Pty) Ltd10 The Bay, La Lucia, 4051, KZN, ZAsupport@revaults.app2. Account-free mobile apps
If you choose to send feedback, a feature request or a bug report, Revault receives your message, its category, your platform, app version and any contact email you enter. Administrators can read these submissions; they are not encrypted with your vault key. No vault contents, keys or installation identifier are attached automatically. Feedback is retained for up to 180 days unless deleted sooner. Daily salted network hashes limit abuse and expire after two days.
The native apps do not require a Revault account, email address, password, or web sign-in. Vaults are created and encrypted on-device. Local vault use does not upload your files to Revault’s servers.
Cloud sync is optional and off by default for new installations. iOS connects directly to your private iCloud CloudKit database. Android connects directly to Google Drive’s hidden appDataFolder after you authorize access. These services receive encrypted files, encrypted metadata, and wrapped keys. Your vault pattern, device unlock secret, raw master key, and recovery secret are not uploaded by sync.
Apple or Google can associate cloud activity with your platform account and observe ciphertext sizes, identifiers, timing, and other operational metadata. Revault does not receive your Apple or Google password. Turning sync off preserves local vaults and does not automatically delete existing cloud copies. Native iCloud, Android Drive, and Revault’s web cloud are separate stores.
3. Website & web accounts
The web app uses passkeys. Account and authentication records include a generated account identifier, passkey public keys and credential identifiers, session records, and security information such as IP addresses and user-agent strings. We use them to authenticate requests, enforce ownership and limits, prevent abuse, and operate the service. Your passkey private key remains with your authenticator.
Web-cloud storage contains encrypted vault records, encrypted file metadata, wrapped encryption keys, and encrypted file segments. The service can observe account associations, object identifiers, counts, sizes, timestamps, upload state, and share settings. It cannot ordinarily decrypt vault contents without the appropriate secrets.
The website uses essential session cookies, tab session state, browser storage for settings and device secrets, and IndexedDB or similar storage for cached ciphertext and upload queues. These support authentication, offline access, and resumable uploads. Browser storage can be cleared or evicted; private browsing may discard it when the private session ends.
4. Encryption, exports & sharing
Encryption happens on your device before cloud upload. Revault uses AES-256-GCM with PBKDF2-SHA-256 and HKDF-SHA-256 in its key wrapping and streaming encryption. See the security model for the full design and limitations.
Phone migration creates an independently encrypted transfer file and a separate transfer key. Import verifies the package and creates fresh vault keys on the receiving device. The source vault is retained. No transfer relay or Revault account is required. Anyone holding both the transfer file and its key can reuse that copy; delete them after verifying the import.
Native file and vault-snapshot sharing creates an independently encrypted copy with fresh keys and identifiers. iOS-to-iOS sharing can use a private, read-only CloudKit invitation. Sharing involving Android uses Revault’s server to store encrypted parts until the sender’s chosen expiry, within 30 days. The invitation and decryption key are separate; the key is never uploaded. The server sees ciphertext sizes, checksums, timestamps and hashed access tokens. Daily salted network buckets enforce abuse limits. The sender can limit access sessions and disable in-app export; these controls cannot prevent screenshots, modified clients or retained copies. Revocation blocks future downloads but cannot remove a recipient’s saved copy.
Tags are encrypted with file metadata. Mobile search uses decrypted filenames and tags only inside an unlocked vault; no search index or query is uploaded. Optional photo and video optimization runs on your device before encryption. It affects newly imported copies, uses temporary private working files and leaves source files untouched. Optimization settings and share-management history are encrypted per vault and kept on this device. Optional per-vault audit logs are off by default, encrypted locally, retain the latest 500 interactions and can be cleared or disabled. They do not sync and contain no keys, patterns or file contents. New controlled shares created with logging enabled also record up to 100 access-session timestamps on the sharing service, available to the sender through their management capability. Disabling local logs affects future shares; existing share logs remain until their share is revoked or expires and is cleaned up.
A shared web link gives its holder access to the file using the link’s secret. The service stores an encrypted share copy and operational information needed to deliver it and enforce its settings. Anyone with the complete link can potentially open or copy the file. Revoking a link cannot recall an already downloaded copy.
Exported decrypted files, screenshots, clipboard contents, and files opened in other apps fall outside the encrypted vault. Individual browser uploads to an S3-compatible bucket go directly to your chosen storage endpoint as ciphertext; that provider sees connection and object metadata. Bucket credentials are handled on your device rather than sent to Revault’s API.
Encryption does not protect unlocked files from a compromised device or malicious software. No system guarantees anonymity, availability, or forensic erasure. Revault has not undergone an independent security audit.
Optional Break-in Alerts
If you enable Break-in Alerts for a mobile vault and grant camera permission, the foreground app may photograph repeated unmatched pattern attempts using the front camera. System camera indicators remain visible. The latest ten photos and attempt records are encrypted locally for that vault, appear in its audit view, and can be cleared or disabled in Settings. They are not uploaded, synced or added to the photo library. An unmatched attempt cannot identify which vault was targeted. Consider the privacy of people using your device before enabling this option.
5. Payments & optional analytics
Web payments use Polar. Mobile purchases, where offered, use Apple’s App Store or Google Play. Payment providers handle payment instruments under their own policies. Revault does not need your full card number to verify a purchase.
Billing records can include product and transaction identifiers, purchase tokens or signed transaction data, subscription status, currency, amounts, refunds, timestamps, and a pseudonymous installation or customer identifier. They support purchase verification, restoring entitlements, accounting, fraud prevention, and financial reporting. A mobile billing installation identifier is not a Revault vault account and does not grant access to your native cloud.
Optional paywall analytics require consent. Events are limited to purchase-screen interactions and product or experiment identifiers, not vault names, patterns, recovery secrets, file names, or file contents. Financial transaction records are separate from optional analytics. There is no advertising tracking or sale of personal information for advertising.
6. Service providers & disclosures
Cloudflare provides web delivery, API infrastructure, and web object storage. The configured database service holds web account, encrypted metadata, and billing records. Polar, Apple, and Google process the payment or cloud features you use. A storage provider you configure receives the uploads you send to it.
Infrastructure providers may process requests, IP addresses, logs, and operational metadata in countries other than yours. Their locations and policies vary. We use available contractual and technical safeguards where required; encryption does not remove international transfer considerations for account or operational data.
We may disclose information we hold when necessary to comply with valid legal obligations, investigate abuse, protect users, or maintain the service. Such disclosure cannot include plaintext vault contents we do not possess. If you contact support, provide only the information needed to investigate; never send your vault pattern, recovery secret, or private encryption keys.
Provider policies: Cloudflare, Polar, Apple, and Google.
7. Retention & deletion
Local encrypted vaults remain until you delete them or the operating system removes the app’s data. Keep encrypted backups and recovery keys separately before uninstalling or clearing storage. Device-bound secrets may be lost when app or browser data is removed.
Web account and encrypted cloud data are retained to provide your account and storage, until deleted or no longer needed for that purpose. Upload cleanup and deletion can complete asynchronously. Security, billing, audit, dispute, and legally required records may be retained longer for those purposes; deletion of a vault does not erase a payment record.
Optional paywall events are retained for the configured period (90 days by default); withdrawing consent removes that installation’s stored optional events. This does not delete legally or operationally necessary transaction records.
Native cloud sync can retain encrypted revision history, backups, or copies on other devices after a logical deletion. Safe Exit removes local access and cached data for other vaults; it does not erase their native-cloud copies. Manage cloud copies through the app and the relevant platform’s storage controls. We cannot delete ciphertext in a personal cloud account on your behalf.
8. Your choices & privacy rights
You can use native vaults without sync, turn sync off, export backups, delete local vaults, control browser storage, and decline optional analytics. Account-free use does not prevent Apple or Google from processing information when you use their cloud or purchase services.
Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, or receive a portable copy of personal information, and to withdraw consent without affecting earlier lawful processing. Where applicable, providing requested services is our contractual basis; security and abuse prevention serve legitimate interests; required financial records meet legal obligations; optional analytics rely on consent.
Contact the operator listed above to make a request. We may need proportionate verification of account ownership. Do not provide vault secrets as proof. We cannot reconstruct a lost encryption key or identify a local-only vault from a name we never received. You may also complain to your local data protection authority.
9. Children & policy updates
Revault is not directed at children below the age at which they can independently consent to data processing in their location. A parent or guardian who believes a child submitted personal information can contact the operator.
We update this page when processing or features change and revise the date above. Material changes will be communicated through an appropriate service notice where practicable. New optional processing that requires consent will not be enabled solely by updating this policy.