Privacy Policy

This Privacy Policy explains how VeraLocker handles information when you use the VeraLocker mobile app, website, support resources, AI features, secure sharing, notifications, and related services.

Overview

VeraLocker is designed as a local-first, encrypted digital locker. Your vault content is stored on your device by default. We do not operate a general cloud sync service for your vault content unless you choose a feature that sends limited information off device, such as AI drafting, secure cloud sharing, support, analytics, push notifications, or purchases handled by an app store.

Contact

VeraLocker is the provider of the app and services described in this policy. You can contact us through the support options listed in the app store listing or at www.veralocker.com/help.

Information You Store In The App

You may choose to store IDs, passports, credentials, asset records, maintenance tasks, reminders, notes, photos, scanned documents, files, binder information, trusted contact records, and similar information in VeraLocker.

By default, this content stays on your device. Vault records, attachments, and encrypted backups are encrypted before storage. VeraLocker does not receive your vault passphrase and cannot decrypt your local vault.

Some local data, such as reminder metadata, app settings, language, country, analytics consent, AI settings, secure sharing settings, and display name, may be stored in device storage so the app can function.

Information Sent Off Device

AI Features

If you enable and use AI features, VeraLocker may send the relevant prompt, model number, maintenance request, playbook request, binder summary, item summary, locale, country, language, and related context to VeraLocker servers and an AI model provider.

AI requests are used to draft tasks, playbooks, product details, and binder analysis. Passwords, recovery codes, TOTP secrets, private keys, and similar secret values are intended to be excluded from AI prompts. You should review AI output before saving it.

Secure Cloud Sharing

If you enable secure cloud sharing, VeraLocker may send encrypted share packages through VeraLocker servers and cloud storage. Share packages are encrypted for the intended recipient before upload. Sharing metadata may include public keys, sender and recipient hashes, object identifiers, timestamps, device attestation data, IP-derived request metadata, and rate-limit data.

Shared packages stored through VeraLocker cloud sharing are configured to expire automatically after 30 days. If you share by QR code, file export, operating system share sheet, or another channel, that channel’s own privacy practices apply.

Push Notifications

If you enable secure sharing push notifications, VeraLocker may collect a push token, platform, recipient hash, and related registration metadata so Apple Push Notification service, Firebase Cloud Messaging, or VeraLocker servers can deliver sharing alerts. Local reminder notifications are scheduled on your device.

Analytics And Error Reporting

Analytics are off by default. If you choose to enable analytics, VeraLocker may collect anonymous usage events, screen views, feature usage, app error information, platform, session identifier, and an anonymous installation identifier. Vault content is not intentionally collected for analytics.

VeraLocker currently uses PostHog for analytics when analytics are enabled.

Device Attestation, API Logs, And Rate Limiting

For server-backed features, VeraLocker may process device attestation data, integrity checks, device identifiers generated by the app, request IDs, route names, status codes, latency, IP address, user agent, and rate-limit records. These records help protect the service, prevent abuse, troubleshoot failures, and operate the API.

Purchases And Subscriptions

If you purchase a paid feature or subscription through an app store, Apple or Google processes your payment information. VeraLocker may receive purchase status, receipt, entitlement, transaction, or subscription metadata needed to unlock paid features and provide support. We do not receive your full payment card details from Apple or Google.

Support And Feedback

If you contact support or submit feedback, we may collect the name, email address, message, diagnostic details, screenshots, files, or other information you choose to provide.

Device Permissions

• Camera access for document scanning, QR scanning, barcode scanning, passport scanning, and adding photos.
• Photo library or document picker access for attachments, imports, exports, and scans you choose.
• Biometric or device credential access for local vault unlocking.
• Notifications for reminders and secure sharing alerts.

VeraLocker does not require location access for its core vault features.

How We Use Information

• Provide and maintain the app and selected services.
• Encrypt, store, import, export, and display vault data on your device.
• Generate AI drafts and suggestions when you request them.
• Send and receive encrypted share packages when you use sharing.
• Deliver local reminders and optional push notifications.
• Process purchases and unlock paid features.
• Protect the service against abuse, fraud, and unauthorized access.
• Debug, monitor, and improve app stability and performance.
• Respond to support requests and feedback.
• Comply with legal obligations.

How We Share Information

• Cloud infrastructure providers that host VeraLocker APIs, storage, logs, and security systems.
• AI model providers used to process AI requests.
• Analytics providers, only when analytics are enabled.
• Apple, Google, Firebase, and related platform providers for app distribution, purchases, push notifications, crash handling, device APIs, and platform integrity.
• Trusted contacts or recipients you choose when sharing data.
• Legal, security, or professional advisors when needed to operate or protect the service.
• Authorities or other parties when required by law or necessary to protect rights, safety, or security.

We do not sell your vault content.

Retention

Local vault content remains on your device until you delete it, reset the vault, uninstall the app, or remove app data through your device settings.

Encrypted cloud share packages are configured to expire automatically after 30 days. API logs, rate-limit data, analytics events, support records, purchase records, and security records are retained only as long as reasonably needed for the purposes described in this policy, unless a longer period is required by law, dispute resolution, security, or financial recordkeeping.

Your Choices

• Delete items, attachments, reminders, contacts, binders, backups, and vault data in the app.
• Reset the vault or uninstall the app to remove local app data from the device, subject to operating system backups.
• Turn analytics off in the app settings.
• Disable AI features in the app settings.
• Disable secure cloud sharing or push notifications in the app settings.
• Revoke camera, photo, biometric, or notification permissions in your operating system settings.
• Manage or cancel app-store subscriptions through Apple or Google.
• Contact us about privacy requests through the support options listed above.

Because VeraLocker is local-first and zero-knowledge for vault content, we generally cannot access, recover, correct, export, or delete vault content stored only on your device.

Security

VeraLocker uses local encryption, key derivation, device keychain storage, biometric access controls where enabled, short-lived server authentication for server-backed features, rate limiting, and encrypted transport where applicable. No system can guarantee perfect security. You are responsible for protecting your device, passphrase, backups, exported files, and shared packages.

If you lose your passphrase and do not have another enabled unlock method or backup, VeraLocker may not be able to recover your vault.

Children’s Privacy

VeraLocker is intended for adults. You must be at least 18 years old to use VeraLocker, as set out in our Terms and Conditions, and we do not knowingly collect personal information from anyone under 18.

Adults may keep records about family members, including children, in their own vault. Those records stay on the adult’s device, and VeraLocker does not receive them unless the adult chooses to share them or send them to a server-backed feature.

International Processing

VeraLocker and its service providers may process information in the United States and other countries where they operate. Those countries may have data protection laws different from the laws where you live.

Changes To This Policy

We may update this Privacy Policy from time to time. The updated policy will be posted with a new effective date. Continued use of VeraLocker after an update means the updated policy applies, to the extent permitted by law.