Docs / Privacy & GDPR/LGPD
Privacy & GDPR/LGPD
Vaultron is built so that there is little to protect on our side: no account, no servers of our own, and your files never pass through Thundera. This page says what is stored where, who is responsible, and how your rights under the GDPR, the LGPD and the LFPDPPP apply to an app that holds no personal data about you.
This page is informational. The Privacy Policy governs. Vaultron is designed in line with GDPR, LGPD and LFPDPPP principles; this page is not a legal opinion or a certification.
Privacy by design
- No account. There is no sign-up, email or login.
- No servers of our own. No Vaultron server receives your files, keys, patterns or recovery phrase. The app talks only to your own iCloud (if you turn backup or sync on) and to the App Store.
- Always encrypted. Files, thumbnails, names, folders and notes are encrypted with AES-256-GCM on the device before they are stored anywhere. See Security.
- No personal data collected, no ads, no tracking. No analytics, advertising or tracking code, and no third-party code in the app.
- Built in the EU by Thundera Group.
What is stored where
| Data | Where it lives | Who can read it |
|---|---|---|
| Photos, videos, files, notes and their names | On your device, encrypted | You, with your pattern |
| Encrypted backup and sync records (if you turn them on) | Your own iCloud account (private database) | Only someone with your recovery phrase. Vaultron keeps no copy of it. Apple stores the encrypted records but cannot open them |
| The device secret that is part of your key | The iOS Keychain, on this device only | Not leaving the device |
| Purchases and subscriptions | Apple (App Store) | Apple handles payment and billing. Thundera does not receive your payment details |
| Anonymous error reports | On your device, up to 20, until you send them or turn the setting off | Thundera support, only if you choose Send to support |
| An email you send to support | Your mail provider and ours | Thundera support (see Contact) |
Who is responsible
Vaultron is made by Thundera Group, based in the European Union. For anything about your privacy, write to hello@thundera.eu.
Error reports
- Settings → Diagnostics → Share errors anonymously. When it is on, Vaultron keeps the error reports iOS provides (crashes, hangs and heavy CPU, disk-write or launch-time use) on the device, up to 20.
- A report holds the app and iOS version, the device model and processor type, the type of error, timings, and where in Vaultron’s code it happened. Dates are cut to the day. It never holds your files, notes, names, location, or any account or device identifier.
- Nothing leaves the device until you send it with Send to support, which opens an email draft from your own address. Your address is then visible to support; the reports carry no identifier.
- Turning the setting off deletes the stored reports.
Your rights
The GDPR (and the Portuguese and Spanish RGPD), Brazil’s LGPD and Mexico’s LFPDPPP give you rights over personal data about you: to know what is held, to access it, to correct it, to have it deleted or to object to its use, and, under GDPR and LGPD, to receive a copy in a portable form and to complain to the data protection authority of your country. In Mexico these are known as the ARCO rights (access, rectification, cancellation, opposition).
How they apply to Vaultron
- In the app there is nothing to request from us. Thundera does not hold your files, keys, patterns or recovery phrase, and the app collects no personal data. Your data is on your device and in your own iCloud, where you already have full control.
- Deletion: delete a vault in Vaultron, or delete the app, to remove the data from the device. Backup and sync data lives in your own iCloud account: manage or delete it in iCloud settings on your device. Deleted data can remain physically in flash storage as ciphertext whose keys are gone, so it cannot be opened.
- Access and portability: you can export your own notes and files from the app. Nobody else has a copy.
- What we can hold: an email you send to support (your address and what you write), and error reports you choose to send. To see, correct or delete these, write to hello@thundera.eu.
- Apple: payments, subscriptions and iCloud are Apple’s services, under Apple’s own terms and privacy notices.
Contact
Questions, requests or complaints about privacy: hello@thundera.eu. For general help, see Vaultron support. The Privacy Policy and Terms of Use are the governing documents.