What stays on your device
- Your photos, videos, files, notes and album names, encrypted with AES-256-GCM.
- Your vault keys. Patterns are never stored; only keys derived from them are, and those are wrapped with a secret kept in the iOS Keychain or Android Keystore.
- Your recovery phrases, inside the encrypted vault.
- Your settings and the log of unrecognized patterns.
None of this is ever sent to us or to anyone else.
What the app does not collect
The app has no account. It uses no analytics, advertising identifiers, crash reporting, location, contacts or tracking of any kind.
Purchases
Payments are processed by Apple or Google; we never see your payment details. To confirm your subscription status we use RevenueCat, Inc., which receives an anonymous app user ID, your purchase receipts, and your device and app version. RevenueCat never receives your vault contents.
Permissions
Sigilock asks for access to your photos, camera and microphone only when you add or capture items. Everything is processed on your device.
This website
sigilock.app uses Google Analytics, provided by Google Ireland Limited and Google LLC, to understand how visitors find and use the site. It sets cookies (such as _ga) and collects the pages you visit, how you arrived, your device and browser type, and your approximate location. Google Analytics does not log or store IP addresses. We look at this information only in aggregate, to improve the website, and never connect it to the app, which has no analytics at all.
Google may process this data outside the European Union, under its certification to the EU-US Data Privacy Framework, and keeps it for the retention period set in our account, at most 14 months. You can block it with your browser’s cookie settings or with Google’s opt-out add-on (tools.google.com/dlpage/gaoptout).
Like any web server, our hosting provider, DigitalOcean, briefly processes your IP address and request details to deliver pages and protect the site from abuse; we do not use them to identify or profile you.
If you write to us through the form at sigilock.app/contact, your name, email address and message are delivered to our mailbox, hosted by Google Workspace. We use them only to reply, and delete them when they are no longer needed.
Retention and deletion
Deleting a vault erases it immediately; uninstalling the App erases all its data. Purchase records are kept by Apple, Google and RevenueCat under their own policies. Contact us to have your RevenueCat purchase data deleted.
Your rights
Depending on where you live (for example under the GDPR or the CCPA) you can ask to access, correct or delete personal data about you, or object to its processing. Contact us through the form at sigilock.app/contact. You can also lodge a complaint with the CNIL (cnil.fr), the French data protection authority, or with the authority where you live.
Children
Sigilock is not directed at children under 13, and we do not knowingly process their data.
Changes and contact
We will announce material changes to this policy in the App and on this page.
Data controller: WEBEE, 50 avenue des Champs-Élysées, 75008 Paris, France. RCS Paris 995 235 579 (SIRET 995 235 579 00019). Contact: sigilock.app/contact.