Privacy policy
Updated
York Vault is made by F9 LLC (“we”, “us”). This policy covers the website yorkvault.com and the web app at app.yorkvault.com. It also covers the York Vault apps for iPhone, iPad, Android and Mac.
Questions or requests: privacy@yorkvault.com.
The short version
- We cannot see what you keep in York Vault. Items, names, dates and codes are encrypted on your device. How.
- The website collects your email only if you write to support. The community forum needs no account and no email address.
- We do not sell personal data. York Vault has no ads.
- The app measures our own ad campaigns with an attribution tool that never receives anything from your library.
What the website collects
Support form and email
If you contact support, we store your email address, the topic, your message, any details you add (error code, app version, iOS or Android version), the country your connection comes from, and the time. We use it to answer you and to fix problems. We keep support requests for 24 months after the last message, then delete them. Never send us your code or your recovery key. We never ask for them.
Community forum
The community forum needs no account and no email address. When you post, we store your display name, the title and text, the category and the time. If you leave the name empty, it is Anonymous. We also store a hash of your IP address. We make that hash with a random value that changes every day. We delete each day’s value after the day ends. After that, nobody can link the hash to your IP address, including us. We use the hash only to limit how often one connection can post, vote or report, and to spot spam. We do not store your IP address in the forum database.
A moderator reads every post before it shows. Approved posts are public until you ask us to remove them, or until we remove them under the community rules. We delete rejected and removed posts 30 days after the decision. A report stores the post, the reason you chose and the daily hash. A vote stores the post and a hash of a random token from your browser’s local storage. It does not store your IP address.
To ask us to remove a post, write to privacy@yorkvault.com with the link to the post. The forum has no accounts, so we cannot confirm who wrote a post. We remove a post that holds personal data when anyone asks.
Spam protection
The support form and the community forum use Cloudflare Turnstile to check that a person, not a bot, sends them. Turnstile reads signals from your browser to make that check. It does not set advertising cookies. Cloudflare’s Turnstile privacy addendum.
Server logs
Like every website, our hosting receives your IP address and browser details with each request. Cloudflare processes these to deliver the site and to protect it from attacks.
Cookies
The website sets no cookies for analytics or advertising. Turnstile may store what it needs to complete its check. If you vote in the community forum, your browser keeps a random token in its local storage, so that you can vote once for each feature request. The token holds no personal data. You can delete it when you clear the site data in your browser.
What the York Vault app collects
- Your library. Photos, videos, files, their names, dates, places and album names are encrypted on your device with keys we never receive. We cannot open them.
- Backup. On iPhone and iPad, backup goes to your own iCloud account (the private CloudKit database), already encrypted. Apple stores it under your Apple Account. On Android, backup goes to your own Google Drive, already encrypted. It uses the app data folder, which only York Vault can read. Google stores it under your Google account. We have no copy of either.
- York Cloud (Pro). If you choose York Cloud, York Vault encrypts your items on your device before upload. Cloudflare stores them for us. We hold only encrypted data and no key. A library on both iPhone and Android syncs through York Cloud.
- Optional 72-hour recovery. This is off until you turn it on. When it is on, a recovery secret goes to iCloud Keychain on iPhone and iPad. On Android, it goes to Google’s Block Store. Apple and Google end-to-end encrypt it. On Android, this needs Android 9 or later and a screen lock.
- Purchases. Apple handles payment for App Store purchases. Google handles payment for Google Play purchases. On iPhone, iPad and Mac, the app checks your purchases on the device. So that your plan works on every device with your library, including across the App Store and Google Play, RevenueCat keeps your plan status under an ID that the app makes from your library key with a one-way function. The ID cannot open your library, and the key cannot be worked out from it. RevenueCat receives the ID, the store, the plan and its dates, and nothing from your library.
- Ad measurement. We run ads on TikTok, Meta and YouTube. To learn which ad brought an install, the app uses an attribution SDK. On iPhone and iPad, it also uses the advertising identifier if you allow it in Apple’s App Tracking Transparency prompt. On Android, it also uses the Google Play Install Referrer, which tells the app which link led to the install. It also uses the Android advertising ID. You can reset or delete the advertising ID in Android Settings > Privacy > Ads (Google’s steps). Some phone makers name these menus differently. This code is kept apart from your library in the app’s design. It never receives items, file names, thumbnails, album names, codes or the recovery key, and it runs the same way in every library.
- Purchase events. When you start a trial, buy, renew, cancel or get a refund, Apple or Google tells our server. Our server then sends the event type and a store transaction ID to our ad measurement partner, Meta and TikTok, so we can learn which ads lead to purchases. It sends nothing from your library. The server keeps only the transaction ID and the event type.
- The web app. The web app at app.yorkvault.com has no account and no password. You scan a QR code with York Vault on your phone. The phone then sends the keys for that session over an end-to-end encrypted channel. The page decrypts your York Cloud items in the browser. The keys stay only in that browser session. Nothing stays in the browser when you close the tab, or after 15 minutes with no activity.
- Support. If you contact support from the app, we receive what you send.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Website hosting, spam protection (Turnstile), the support and community forum database (D1), sending and receiving our email, and York Cloud storage (encrypted data only) | Global network, United States company |
| Convex, Inc. | The database behind our shared email inbox, which stores support messages | United States |
| Apple Inc. | App Store, payments, iCloud backup in your own account, and the optional recovery secret in iCloud Keychain | Under your agreement with Apple |
| RevenueCat, Inc. | Keeping the status of your plan under your library ID, for both stores | United States |
| Our ad measurement partner, Meta Platforms, Inc. and TikTok | Measuring which of our ads lead to installs and purchases (install signals, the allow-listed app events, and purchase events from our server) | United States and other countries, under their data processing terms |
| Google Play (app distribution, payments and the Install Referrer), Google Drive backup in your own account, and the optional recovery secret in Block Store | Under your agreement with Google |
When data moves outside your country, including from the EU or UK to the United States, we rely on our providers’ data processing terms, including Standard Contractual Clauses where they apply.
Your rights
Depending on where you live, including under the GDPR, UK GDPR and California law, you can ask us to:
- show you the personal data we hold about you,
- correct it,
- delete it,
- give you a copy,
- stop using it for a purpose, or limit how we use it.
Write to privacy@yorkvault.com. We answer within 30 days. We may ask you to confirm the email address the request is about. You can also complain to your local data protection authority.
Legal bases (EU and UK)
- Support: to answer the request you sent us.
- Community forum: our legitimate interest in running a moderated forum, and to publish the post you chose to send us.
- Spam protection and server logs: our legitimate interest in keeping the site working and safe.
Children
The website is not directed at children under 13, and we do not knowingly collect their data. If you think a child sent us personal data, write to privacy@yorkvault.com and we will delete it.
Changes
We change this policy when what we collect changes. The date at the top shows the last change. For a significant change, we say so on this page and in the app.