Krypli privacy policy

Last updated: November 2, 2026

Krypli is developed by Arseni Kipachu ("we", "us"). This policy covers the app and its prelaunch website at krypli.com. Contact kipachu_dev@outlook.com with privacy questions or requests.

The current TestFlight app, version 0.1.0 (16), does not include the Apple Ads measurement or purchase-identity linking described as prepared below. Those changes apply only to a later app version that includes them. The prelaunch website has its own analytics, described separately below.

Your vault and recovery information

Krypli stores encrypted copies of the photos, videos, documents, and notes you add to a vault on your device. Vault names, filenames, folders, and note text form part of the encrypted vault data. The app decrypts content on your device when needed to display, play, or export it. Previewing, importing, and sharing can create temporary decrypted files in app-controlled storage protected by iOS. The app attempts to remove these temporary files after use, on lock, and when its native media service starts.

We do not receive your vault contents, unlock patterns, encryption keys, or recovery phrases. We do not upload them to RevenueCat, PostHog, or a developer-operated storage service. Krypli does not require a developer account, email address, or app login.

Keep your recovery phrase somewhere safe. We cannot retrieve it for you or unlock your vault for you. Exported backups can still require the recovery phrase used when those backups were created, even after you change the phrase for your current vault.

If you enable Face ID or Touch ID, iOS checks your identity and controls access to protected Keychain information. Krypli receives an authentication result. We do not receive or collect your face, fingerprint, or biometric template.

Imports, originals, and exports

Krypli accesses the files or Photos items you select. Importing creates an encrypted vault copy and keeps the original by default. Where the app offers to remove a Photos original, removal requires a verified vault copy, your separate confirmation, and the system's Photos deletion confirmation. Photos and iCloud Photos manage any remaining original or Recently Deleted copy under your Apple settings.

When you export or share content, the destination you choose receives that content. An exported photo, document, video, or note is no longer protected by Krypli's vault encryption. An encrypted backup remains encrypted, but the destination still controls storage and access to that backup file.

Krypli requests Photos, camera, microphone, or biometric access when needed for the corresponding feature. You can manage permissions in iOS Settings. Declining a permission can prevent that feature from working.

Optional iCloud copies and backups

If you enable Krypli's iCloud features, the app sends encrypted vault copies or encrypted backup files to the app's private CloudKit database in your own iCloud account. Automatic backups operate only if you enable them. These features require the relevant Apple account, connectivity, and available iCloud storage.

Cloud records also contain the technical information needed to store and update encrypted copies, such as opaque record identifiers, backup times, and version information. These records are separate from the PostHog usage events described below. We do not receive your iCloud password or your vault's decryption keys.

Files you export to iCloud Drive, device backups, and copies you share elsewhere are separate from Krypli's CloudKit copies. Apple handles iCloud account information and connection information under Apple's privacy policy. Apple's iCloud data security overview describes its own protections and account options.

Purchases and RevenueCat

Apple processes App Store purchases through your Apple Account. We do not receive your payment-card number or Apple Account password.

Krypli uses RevenueCat to check paid access, restore purchases, deliver purchase screens, and understand purchase and paywall performance. RevenueCat processes purchase history and transaction verification information, including product and transaction identifiers, purchase dates, and subscription or entitlement status. Its SDK also processes a generated app-user identifier and normal service context, such as app and SDK versions, operating-system information, store, locale, and currency. RevenueCat receives the network connection information needed to provide its service.

Krypli does not supply RevenueCat with your name, email address, vault identifiers, vault contents, filenames, patterns, or recovery phrases. Automatic device-identifier collection is disabled.

TestFlight build 16 does not send Krypli's PostHog identifier to RevenueCat. In the prepared update, the app will send its existing random analytics installation identifier to RevenueCat while usage analytics is on, and clear that attribute when analytics is off. This allows app usage and purchase identity to be linked without an account or login. The app keeps using its existing PostHog identifier. It does not connect website visitors to installed app users.

RevenueCat-to-PostHog forwarding of server subscription events is currently disabled. Renewal and refund event delivery through that integration has not been verified, and is not part of the current analytics collection.

RevenueCat can connect when the app starts, checks access, loads a purchase screen, or restores purchases. These purchase services operate separately from usage analytics and any saved analytics preference. See RevenueCat's privacy policy for its practices.

Usage analytics and PostHog

Basic PostHog usage analytics is on by default, without a separate setup prompt. Starting with build 15, the app does not show an analytics control in Settings. Krypli continues to honor a saved choice to turn analytics off from an earlier version. Contact us using the address below for privacy questions or requests.

While usage analytics is on, Krypli sends selected events about app launches, setup, known screens, feature use, and purchase or restore outcomes. Approved event fields include fixed screen and action categories, operation outcomes, limited error categories, count ranges, purchase-plan categories, whether paid access is active, and app version, platform, and environment. Events include timestamps and a random installation identifier that connects visits from the same app installation.

This identifier is stored locally for analytics. It is pseudonymous: it can connect events over time even though we do not attach your name or email address. The event history can distinguish one installation from another. The prepared update will also use this identifier for a PostHog profile containing only the approved acquisition fields described below.

Krypli filters events against a fixed allowlist. Events exclude your media, documents, note text, names, filenames, vault or item identifiers, unlock patterns, recovery phrases, encryption keys, clipboard contents, search text, raw error messages, file paths, URLs, and referrers. Automatic interaction capture, screen or session recordings, automatic exception reporting, and IP-based location enrichment are disabled. The app does not include an IP address in the event payload. PostHog still receives the network connection needed to deliver events.

A saved choice to turn analytics off prevents new event delivery. Events already received by PostHog are not automatically deleted. See PostHog's privacy policy for its practices.

Krypli does not use device advertising identifiers or track you across other companies' apps and websites for targeted advertising. We do not sell your personal information.

Prepared Apple Ads measurement

In a later app version that includes these changes, Krypli will check Apple's AdServices attribution while usage analytics is on. The native app will send Apple's attribution token only to Apple's fixed HTTPS service. The token will not enter JavaScript, PostHog, or app logs. The lookup uses a temporary network session with limited waits, response size, and retries.

Krypli will record whether the lookup is pending, matched an Apple Ads campaign, returned no match, was unavailable, or failed. A positive match can include Apple's organization, campaign, ad group, and keyword identifiers when Apple supplies them. Failed lookups include only a limited error category. These results will accompany app analytics and the matching acquisition profile. App events will also include the native app version and build.

The app will also record when this measurement first observed the installation and whether earlier app usage had already been observed. That observation is not necessarily the installation date. A missing or negative Apple result does not establish that an installation was organic. We cannot identify the source of every installation.

This measurement does not use IDFA, request an App Tracking Transparency permission prompt, or infer a source from IP addresses, timing, or device fingerprints. A saved choice to turn analytics off also disables this lookup and the prepared analytics-to-purchase identity link.

App Store update checks

Krypli can contact Apple's public App Store lookup service to check its current release. The request includes Krypli's app identifier and a storefront country code. It does not include vault information or the app's analytics identifier. Apple receives the connection information needed to answer the request, and Krypli caches the listing information locally.

The Krypli prelaunch website

The site at krypli.com uses PostHog to count page views and, when a public App Store link becomes available, App Store button clicks. Its current buttons say Coming soon, so they do not produce App Store click events.

Website events contain the canonical page path, approved source and campaign categories, and limited technical fields needed to deliver the event. They exclude raw query strings, referrers, page content, and personal information supplied in a URL. We do not include an IP address in event payloads or use IP-based location enrichment. PostHog and the hosting provider still receive the connection information, including an IP address, needed to handle network requests.

Website analytics uses a random identifier held only in the page's memory. It does not store visitor identifiers in cookies, local storage, or session storage. Automatic interaction capture, session recordings, remote configuration, and fingerprinting are disabled. A new page can have a new identifier, so page counts do not represent unique visitors across pages.

Registered website, referral, and social campaign tags can pass through links between pages on krypli.com. Only approved marketing values are retained, without personal or visitor identifiers in the URLs. Untagged visits remain unclassified. These tags do not automatically reach an installed iOS app, and we do not match website visitors to app users.

Apple's campaign reports can provide aggregate download information. Those reports are currently unavailable for Krypli, and the Apple campaign-link configuration has not been verified. Website visits and clicks do not prove that an installation occurred.

Cloudflare hosts krypli.com and processes requests needed to serve it. See Cloudflare's privacy policy and PostHog's privacy policy for their practices.

Support and policy pages

If you email us, we receive your email address, message, and attachments you choose to send. We use these to answer your request and investigate the issue. You do not need to send vault contents to ask for help. Never send an unlock pattern, recovery phrase, encryption key, Apple Account password, or full payment details.

Opening this policy or a support page uses your browser and an internet connection. The website's hosting provider receives the request information needed to serve the page. Opening a link does not send your vault contents. For general assistance, see Kipachu support.

Retention, deletion, and your choices

Vault data stays in the app's local storage unless removed by the app, you, or the operating system. Items in Recently removed remain encrypted and available to restore. Moving an item there does not permanently erase its encrypted copy.

Removing Krypli removes its local app storage, but does not necessarily remove Keychain records, iCloud copies, exported files, device backups, or records already held by service providers. Delete separately saved copies at their destinations. Deleting the app does not cancel an Apple subscription. Manage subscriptions in your Apple Account settings.

Apple and RevenueCat can retain purchase records to provide and restore access, prevent fraud, and meet legal requirements. We retain received usage and support information as needed for the purposes described here, subject to applicable service settings and legal obligations. Uninstalling the app does not automatically erase those existing records.

We use the described information to provide requested features, manage purchases, improve reliability with app usage analytics when enabled, measure website traffic as described above, and respond to support. Apple, RevenueCat, PostHog, and our email and hosting providers process information needed for their respective services. These providers may process information outside your country. Information may also be disclosed where legally required or necessary to protect legal rights.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information, restrict or object to processing, withdraw consent, or complain to a data-protection authority. Email kipachu_dev@outlook.com to make a request. We may need limited information to verify your request and locate relevant records. Because Krypli has no developer account, an email address alone may not identify a purchase or analytics record. After analytics is turned off and its local identifier is erased, we may be unable to connect earlier events to your request. Do not send vault secrets to establish your identity.

Changes

We will update this page and its date when Krypli's data practices change. Where required, we will provide additional notice or request a new choice.