Privacy policy
Last updated 2 November 2026
The short version
- Your files, messages, contact names and unlock patterns stay encrypted on your iPhone. We cannot see them.
- You don't need a phone number, email address or account to use Vaultalk.
- Our server only passes on sealed messages, and deletes each one once it has been delivered.
- We don't sell data, show adverts or track you.
1. Who we are
Vaultalk is provided by Exeter Space Limited, a company registered in England and Wales (company number 16824447). In this policy, "we", "us" and "our" mean Exeter Space Limited.
We are the controller of the personal data described here under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For any privacy question or request, email [email protected].
2. What stays on your iPhone
Vaultalk is built so that the things you care about most never reach us. The following are stored only on your iPhone, encrypted with keys held in your iPhone's Secure Enclave and Keychain and set so they are never copied to iCloud:
- the files, photos, videos and notes in your vaults
- your messages, once your phone has received them
- your contacts library, including the names you give your contacts
- your unlock patterns, recovery key and settings
We have no copy of any of this and no way to read, recover or reset it.
3. What our server handles
To deliver messages between Vaultalk users, our relay server processes a small amount of data:
- Your Vaultalk ID. A random 8-character code created on your phone. It is not linked to your name, phone number or email address.
- Your public keys. These let other users encrypt messages that only you can open. They are public by design and reveal nothing about you.
- A device identifier. A random code created by the app so that only your phone can collect your messages.
- A push notification token. If you allow notifications, Apple gives the app a token so we can send you a "New message" alert. Alerts never include a name or any message content.
- Encrypted messages in transit. Each message is held only until your phone collects it, then deleted. Messages that are never collected are deleted after 30 days. We cannot read them.
- Delivery details. The sender's ID, the recipient's ID and the time a message was sent. Group messages are sent to each member separately, so our server does not know a group exists.
- Blocks. If you block someone, we record that their ID is blocked by yours so their messages to you are dropped.
- Reports. If you report a user, we receive the reported ID and only what you choose to include.
Our server is run by Cloudflare, which processes your device's IP address to route requests and protect the service from attacks. We do not store IP addresses in our message database or use them to identify you.
4. iCloud backup (Pro)
If you use automatic backup, the app encrypts your backup on your phone before it is saved to your own iCloud account. Neither we nor Apple can read it. The backup is stored by Apple under your iCloud terms. If self-destruct is on and you have chosen to include your backup, it is deleted along with everything else.
5. Subscriptions and payments
Pro subscriptions are bought through the Apple App Store. Apple handles your payment and billing details under its own privacy policy. The app only learns whether your subscription is active. We never see your card details or your Apple ID.
6. Self-destruct and deleting your data
When self-destruct is triggered, the app deletes the key that unlocks your data, so everything on your phone becomes unreadable at once. The app also tells our server to remove your ID, public keys, device identifier, push token and any messages waiting for you. Resetting your ID in the app does the same on our server.
If you delete the app without resetting your ID first, email us with your Vaultalk ID and we will remove it. We may ask you to prove the ID is yours before we do.
7. When you contact us
If you email us, we receive your email address and whatever you write. We use it only to reply and deal with your request, and we keep the correspondence for no longer than two years.
8. Our website
vaultalk.net does not use analytics, advertising or tracking cookies. Our hosting provider processes your IP address to deliver the pages to your browser.
9. Why we use your data
Data protection law requires us to have a lawful basis for each use of personal data:
| What we do | Lawful basis |
|---|---|
| Deliver messages and notifications, and apply blocks | Performing our contract with you |
| Keep the service secure and prevent spam and abuse | Our legitimate interests in running a safe service |
| Review reports about other users | Legal obligation under the Online Safety Act 2023, and our legitimate interests |
| Reply to your emails | Our legitimate interests in helping you |
| Respond to lawful requests from authorities | Legal obligation |
10. Who we share data with
We never sell your data. We use these service providers, who act only on our instructions:
- Cloudflare, Inc. runs our relay server and database.
- Apple Inc. delivers push notifications and handles App Store purchases.
We will only disclose data to the police or other authorities where the law requires it. Even then, all we hold is the data in section 3. We cannot decrypt your messages or files, because we never have the keys.
11. International transfers
Our database is stored in Western Europe. Cloudflare and Apple are based in the United States and may process data outside the UK. Where they do, the transfer is protected by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum, as appropriate.
12. How long we keep data
| Data | How long |
|---|---|
| Encrypted messages | Until your phone collects them, and no longer than 30 days |
| ID, public keys, device identifier and push token | While you use Vaultalk. Deleted on self-destruct, ID reset or request |
| Blocks | Until you unblock the user or your ID is deleted |
| Reports | Up to 12 months, unless needed longer for a legal reason |
| Emails to us | Up to two years |
13. How we protect data
Every file is encrypted with its own AES-256 key. Messages are end-to-end encrypted on the sender's phone and can only be opened on the recipient's. Every request to our server is signed by your device, so nobody else can collect your messages or act as you. All data travelling between the app and our server is also protected by TLS.
14. Your rights
You have the right to ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. To use any of these rights, email [email protected] with your Vaultalk ID. We will reply within one month.
Because we hold so little and cannot link an ID to a person, we may need you to prove the ID is yours before we can act.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.
15. Children
Vaultalk is only for adults aged 18 and over. If you believe someone under 18 is using Vaultalk, please contact us and we will act on it.
16. Changes to this policy
If we change this policy, we will update this page and the date at the top. If a change is significant, we will also tell you in the app.
17. Contact us
Exeter Space Limited
Email: [email protected]