Vault Horizon

PRIVACY POLICY (VAULT HORIZON APP)

Last Updated: January 22, 20261. Introduction & Core PhilosophyVault Horizon ("we", "our", or "the App") is built on a Zero-Knowledge philosophy. We believe that privacy is a fundamental human right, not an optional feature. Our architecture is designed so that even as the developers, we have no technical means to access your sensitive documents.2. The Data Fortress: Security ArchitectureOur commitment to your privacy is enforced through three layers of "invisible walls":Host-Proof Encryption: All document scans are encrypted on your device using AES-256 before they are transmitted. We only ever receive and store "meaningless ciphertext".Secure Enclave Integration: Your local access is protected by the iOS Secure Enclave. Biometric data (Face ID/Touch ID) never leaves your device and is used exclusively to unlock your local vault.Row-Level Security (RLS): Every document is cryptographically isolated at the database level. RLS ensures that your data is invisible to all other users, and access is rejected even if a server-side vulnerability is discovered.3. Minimal Data CollectionWe follow a strict Data Minimization mandate. We do not collect or store what we do not need.We DO NOT Collect: Real names, physical addresses, GPS locations, contacts, or browsing history.We DO NOT Use: Third-party tracking SDKs, advertising IDs (IDFA), or behavioral analytics that identify you.We DO Collect: An anonymized Apple ID identifier for authentication and the document metadata you voluntarily provide to set reminders.4. Third-Party InfrastructureWe partner with world-class infrastructure providers that adhere to the highest security standards.Hosting: Data is stored using Supabase, hosted on AWS/Google Cloud in [Insert Region, e.g., EU-West-1] to ensure data residency compliance.Compliance: Our infrastructure partners undergo regular SOC 2 Type II and ISO 27001 audits.Transmission: All data moves over TLS 1.3 encrypted tunnels, providing an additional layer of protection in transit.5. Your Rights: The "Nuclear Option"In accordance with GDPR (Article 17) and CCPA, you have total control over your digital identity.Right to Erasure: You may trigger an immediate and permanent deletion of your account and all associated data through the "Delete Account" button in Settings.Instant Purge: Upon request, our systems execute a script that wipes your Auth records, Storage files, and Database rows across all server copies.Irrecoverability: Due to our Zero-Knowledge architecture, once you delete your data or lose your keys, it cannot be recovered by us.6. Transparency & AuditsWe strive for "Glass-Box" transparency. We do not respond to "Do Not Track" signals because we do not track our users to begin with. Significant policy changes will be communicated via in-app notifications.7. Contact InformationFor privacy inquiries or to exercise your data rights: Email: [email protected]