English 简体中文 繁體中文
Last updated: October 9, 2026

Privacy Policy

Your privacy is the foundation of CryptoBox. This policy explains, in plain language, what data the app handles, how that data is protected, and the choices available to you.

On this page

  1. Overview
  2. Information we collect
  3. How we use information
  4. Device permissions
  5. Encryption and on-device storage
  6. Sharing and disclosure
  7. Third-party services
  8. Data retention
  9. Children's privacy
  10. Your rights
  11. Changes to this policy
  12. Contact us

1. Overview

CryptoBox (the "App", "we", "us", or "our") is a privacy-first encrypted vault for storing photos, files, passwords, two-factor authentication codes, identity records, and personal notes. This Privacy Policy describes how the App handles your information.

Our guiding principle is simple: your data belongs to you. CryptoBox is designed so that the data you place in the vault always stays on your device and is encrypted with a master password that only you know.

2. Information we collect

2.1 Information you provide to the app

When you use CryptoBox, you may choose to add the following types of content to your encrypted vault:

  • Photos and videos imported into encrypted albums.
  • Files and documents imported into the file vault.
  • Login credentials, including usernames, passwords, websites, and tags.
  • Payment card information, including card numbers, expiry dates, and notes.
  • Identity records, including names, addresses, and identification numbers you choose to enter.
  • Two-factor authentication secrets (TOTP) added by scanning a QR code or an otpauth:// URI.
  • Encrypted memos and notes, with the option to add reminders.
  • Your master password, which is used to derive the encryption key. The plaintext master password is never stored or transmitted.

All content is encrypted on your device before it is written to disk. We do not keep a copy, and we cannot read it.

2.2 Information we do not collect

You can use CryptoBox without creating an account, registering an email address, or providing any personally identifying information. We do not collect:

  • Your name, email address, or phone number.
  • Your master password (in any form, including a hash).
  • The contents of your vault, including filenames, metadata, or thumbnails.
  • Your contacts, calendar, location, or microphone data.
  • Behavioral or advertising profiles based on vault contents. Advertising-related behavioral data is used only to display ads inside this App, and is not used to build profiles from information in your vault.

2.3 Diagnostic data

If you choose to share diagnostic information, the app may send anonymized, aggregated crash logs to help us fix bugs. This data does not include the contents of your vault and cannot be linked to your identity. Diagnostics are off by default.

2.4 Advertising and analytics data

This App integrates third-party advertising SDKs and analytics SDKs.

  • Device identifiers: our advertising partners collect device IDs and user IDs to serve third-party ads within this App, optimize ad delivery, and measure ad performance.
  • Product interaction data: we and our analytics providers collect product interaction events (such as app launches, page views, taps, and session duration). This behavioral data is associated with a device ID or user ID and is used to analyze the product experience and improve features.

Product interaction data is used only for analysis inside this App. It is not used to track you across apps or websites, and it is not combined with external third-party data sets for targeted advertising.

Collection of advertising and analytics data does not read any content inside your encrypted vault.

3. How we use information

Because the App does not collect personal data on our servers, your information is "used" only locally on your device:

  • To encrypt, store, search, and display the items you add to the vault.
  • To compute on-device features such as your security score, password health, and 2FA codes.
  • To deliver local reminders for encrypted memos.
  • To support iOS features you explicitly enable, such as Face ID or Touch ID unlock.

If you opt in, anonymous diagnostic data is used only to identify and fix crashes or performance issues.

Advertising-related data is used to display third-party ads within this App and to optimize ad delivery. Product interaction data is used to measure how the product is used and to improve app features and the user experience.

4. Device permissions

CryptoBox requests the following device permissions only when you actively use a related feature:

  • Photos / Files: used to import photos, videos, and files into the encrypted vault. Selected items are copied into the encrypted vault, and you can choose to delete the originals.
  • Camera: used to scan QR codes when adding two-factor authentication accounts. The camera image is processed in memory and is not recorded.
  • Face ID / Touch ID (Local Authentication): used only as an optional shortcut to unlock the vault. Biometric data never leaves the iOS Secure Enclave.
  • Notifications: used only to trigger local reminders for encrypted memos.

You can revoke any permission at any time in iOS Settings.

5. Encryption and on-device storage

CryptoBox uses industry-standard encryption to protect your vault:

  • Vault contents are encrypted with AES-256-GCM authenticated encryption.
  • Encryption keys are derived from the master password using a memory-hard key derivation function (such as Argon2id), with a unique random salt for each vault.
  • Album passwords can add an extra encryption layer to a specific album.
  • The plaintext master password is never written to disk and is never transmitted over the network.

The encrypted vault is stored inside the app's sandboxed container on your device. Without the master password, decrypting the vault is mathematically infeasible. We cannot recover your password or your data for you.

6. Sharing and disclosure

We do not sell, rent, or trade your personal data. Because the contents of your vault always remain on your device, we have no vault-related information to share. We disclose limited account or usage information only when required by law, for example to comply with a valid subpoena, court order, or other legal process.

We share device identifiers and product interaction event data with third-party advertising and analytics providers, solely for the ad delivery and product analysis purposes described in this policy.

7. Third-party services

CryptoBox integrates the following third-party services:

  • Distribution and updates through the Apple App Store.
  • Apple iCloud backs up the encrypted vault file only if you enable iCloud Backup in iOS Settings. In that case, the encrypted vault file may be included in your encrypted iOS device backup. We cannot access that file.
  • Apple StoreKit is used only if you choose to make an in-app purchase. We never receive your payment card details.
  • Third-party advertising SDKs: used to display third-party ads within this App. Providers may receive device IDs and user IDs for ad delivery and performance optimization.
  • Third-party analytics SDKs: used to collect in-app product interaction events so we can understand product usage and improve the app experience.

Third-party advertising and analytics providers may process data only as described in this Privacy Policy. They have no right to access any files, credentials, or other contents of your encrypted vault.

8. Data retention

You decide how long vault data is kept. You can delete individual items, an entire album, or wipe the whole vault at any time. Uninstalling the app deletes all encrypted data from the device. We do not keep any server-side copy of your vault.

Advertising and analytics data is retained by third-party providers in accordance with their privacy policies and applicable law.

9. Children's privacy

CryptoBox is not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate steps.

10. Your rights

Depending on where you live, you may have rights under applicable privacy laws (such as the GDPR, UK GDPR, or CCPA), including the right to access, correct, delete, or port your personal data, or to object to certain processing. Because CryptoBox stores your vault data only on your device:

  • Access and portability: you can view and export your data directly in the app.
  • Correction: you can edit any record at any time.
  • Deletion: you can delete records, albums, or the entire vault in the app.
  • Objection / withdrawal of consent: you can turn off optional features such as diagnostic sharing in Settings.

For data collection related to advertising and analytics, you can also limit ad tracking in iOS Settings.

If you have further questions about exercising your rights, please contact us at the address below.

11. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect new features or to comply with legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you in the app. Your continued use of CryptoBox after the changes take effect means you accept the updated policy.

12. Contact us

If you have any questions, requests, or concerns about this Privacy Policy or your personal data, please contact us:

Email: privacy@cryptobox.app
Support: Support Center

We will do our best to respond within a reasonable time.