Privacy
What We Collect
We use PostHog for basic product usage analytics only, such as feature usage, button clicks, and app performance signals that help us improve Mavaul. We do not send vault content through analytics, including images, videos, vault text, email contents, or other private media.
This website also uses PostHog to count page views and clicks, such as taps on the App Store link. It runs without cookies or local storage, so nothing is saved on your device.
Purchases And Subscriptions
We use RevenueCat to manage in-app purchases and subscriptions. RevenueCat helps process subscription status, entitlements, renewals, and related purchase metadata. We do not share your private vault content, images, videos, or private text with RevenueCat.
What We Do Not Collect
We do not track users and cannot see your media content. We do not read, view, or index photos/videos stored inside the app.
On-Device Data
Your vault uses AES encryption on your device for privacy protection. Images and videos are stored locally on your phone and are not uploaded to our servers by default, so we cannot access them. Without the optional Email Recovery feature enabled, we cannot help you regain access if you lose your passcode and recovery key.
Encrypted Backups
Encrypted Backup is an optional premium feature that lets you manually back up your already-encrypted vault to storage you control. You can connect Dropbox, WebDAV/Nextcloud, or save a backup zip to Files on iOS. Mavaul does not host, store, or access your backup files on our servers.
Backups are encrypted on your device with AES-256-GCM before they leave your phone. Dropbox, Nextcloud, and other providers store ciphertext — they cannot read your vault contents. Backups are manual only; Mavaul does not automatically sync your vault to the cloud.
To restore on a new device, you need your recovery key and must set a new passcode. We do not provide restore access without your recovery key. Third-party storage providers have their own privacy policies and security practices, which apply to backup files stored in your account.
Email Recovery
Email Recovery is an optional premium feature that lets you receive your 24-character recovery key by email. If you enable it, you provide an email address in the app. Mavaul then sends your recovery key to that address using a secure transactional email service (Loops) from our verified sending domain, recovery.mavaul.com.
Your recovery key is not stored long-term on our servers. It is transmitted only when you enable the feature or request a resend. Emails are sent as transactional messages with no tracking pixels or unsubscribe links. Each email includes security warnings, and you must still manually enter the key in the app — it does not automatically unlock your vault.
Email Recovery is processed by a dedicated Cloudflare Worker at recovery.mavaul.com. We store only the email address needed to deliver recovery messages and your subscription entitlement status. We do not store your vault media, passcode, or recovery key on our servers after delivery.
Your recovery email address is separate from launch-notification signups on this website and is not used for marketing. See our Terms of Use for limitations on the Email Recovery service.
Local Network Sharing
If you enable local WiFi sharing/casting features, your content visibility depends on your own network setup and connected devices. You are responsible for who has access to your local network.
Who Is Responsible
Mavaul is operated by Diogo Ferreira, Braga, Portugal, who is the data controller for the personal data described on this page. You can reach us about anything privacy-related at hello@mavaul.com. We have not appointed a data protection officer.
Why We Process Data And On What Basis
Product and website analytics (PostHog): our legitimate interest in understanding how Mavaul is used so we can fix problems and improve it. This data never includes vault content, and the website version stores nothing on your device.
Purchases and subscriptions (RevenueCat, Apple, Google): performance of our contract with you, so we can provide the premium features you paid for.
Email Recovery (Cloudflare, Loops): your consent, given when you turn the feature on and enter your email address.
You are not required by law or contract to give us any personal data. If you choose not to provide an email address, Email Recovery will not be available; everything else in the app works without it.
Who Receives Data
We share data only with the service providers that run these features for us: PostHog (analytics, hosted in the EU), RevenueCat (subscriptions), Loops (recovery emails), and Cloudflare (website and recovery service hosting). Apple and Google process purchases under their own privacy policies. We do not sell personal data or share it for advertising.
Some of these providers are based in the United States. Where data leaves the European Economic Area, it is protected by safeguards such as the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How Long We Keep Data
Your recovery email address is kept for as long as Email Recovery is enabled, and deleted when you turn the feature off or ask us to delete it. Subscription records are kept for as long as you have a subscription and afterwards only as long as required for accounting and tax obligations. Analytics data is kept only as long as it is useful for improving Mavaul and is then deleted.
Your Rights
If you are in the European Economic Area, the United Kingdom, or a place with similar laws, you have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to how we process it, and to withdraw consent at any time. Withdrawing consent does not affect processing that happened before you withdrew it. To use any of these rights, email hello@mavaul.com.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular the one in the country where you live or work. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).
Policy Updates
We may update this Privacy page to reflect product changes or legal requirements. We will revise the "Last updated" date when changes are made.
Contact
Privacy questions: hello@mavaul.com