---
title: Mavaul | Privacy
canonical: https://mavaul.com/privacy/
description: Mavaul privacy policy describing analytics, on-device encryption, and data handling.
updated: July 13, 2026
format: text/markdown
generator: scripts/generate-llms.js
---
# Privacy

_Last updated: July 13, 2026_

## What We Collect
We use PostHog for basic product usage analytics only, such as feature usage, button clicks, and app performance signals that help us improve Mavaul. We do not send vault content through analytics, including images, videos, vault text, email contents, or other private media.

## Purchases And Subscriptions
We use RevenueCat to manage in-app purchases and subscriptions. RevenueCat helps process subscription status, entitlements, renewals, and related purchase metadata. We do not share your private vault content, images, videos, or private text with RevenueCat.

## What We Do Not Collect
We do not track users and cannot see your media content. We do not read, view, or index photos/videos stored inside the app.

## On-Device Data
Your vault uses AES encryption on your device for privacy protection. Images and videos are stored locally on your phone and are not uploaded to our servers by default, so we cannot access them. Without the optional Email Recovery feature enabled, we cannot help you regain access if you lose your passcode and recovery key.

## Encrypted Backups
Encrypted Backup is an optional premium feature that lets you manually back up your already-encrypted vault to storage you control. You can connect Dropbox, WebDAV/Nextcloud, or save a backup zip to Files on iOS. Mavaul does not host, store, or access your backup files on our servers.

Backups are encrypted on your device with AES-256-GCM before they leave your phone. Dropbox, Nextcloud, and other providers store ciphertext — they cannot read your vault contents. Backups are manual only; Mavaul does not automatically sync your vault to the cloud.

To restore on a new device, you need your recovery key and must set a new passcode. We do not provide restore access without your recovery key. Third-party storage providers have their own privacy policies and security practices, which apply to backup files stored in your account.

## Email Recovery
Email Recovery is an optional premium feature that lets you receive your 24-character recovery key by email. If you enable it, you provide an email address in the app. Mavaul then sends your recovery key to that address using a secure transactional email service (Loops) from our verified sending domain, recovery.mavaul.com.

Your recovery key is not stored long-term on our servers. It is transmitted only when you enable the feature or request a resend. Emails are sent as transactional messages with no tracking pixels or unsubscribe links. Each email includes security warnings, and you must still manually enter the key in the app — it does not automatically unlock your vault.

Email Recovery is processed by a dedicated Cloudflare Worker at recovery.mavaul.com. We store only the email address needed to deliver recovery messages and your subscription entitlement status. We do not store your vault media, passcode, or recovery key on our servers after delivery.

Your recovery email address is separate from launch-notification signups on this website and is not used for marketing. See our [Terms of Use](/terms/) for limitations on the Email Recovery service.

## Local Network Sharing
If you enable local WiFi sharing/casting features, your content visibility depends on your own network setup and connected devices. You are responsible for who has access to your local network.

## Policy Updates
We may update this Privacy page to reflect product changes or legal requirements. We will revise the "Last updated" date when changes are made.

## Contact
Privacy questions: [hello@mavaul.com](mailto:hello@mavaul.com)