Privacy Policy
Effective date: 2 September 2026 · Applies to Cryo Dungeon (web, Android, iOS) and www.cryodungeonenclave.com.
This policy describes how Cryo Dungeon handles data today: vault contents and passphrases stay on your device; optional cloud sync transmits only end-to-end encrypted ciphertext and blind indexes. No ad SDKs, no third-party analytics in the app. Contact: privacy inquiries via the support email listed in app store listings once published.
The short version
Your master password never leaves your device, and the encryption key derived from it is generated in a form your device's own operating system marks non-extractable — it cannot be exported, even by the app itself.
With sync turned off, which is the default, no vault content, usage analytics, or advertising identifiers are sent anywhere. There is no analytics SDK and no ad SDK in this app.
If you turn on multi-device sync, only already-encrypted ciphertext travels through the relay. The relay has no key and cannot read it — it's a pass-through, not a vault.
What this app does not do
- No third-party analytics, crash-reporting, or advertising SDKs are embedded in the app.
- No vault contents (entries, passwords, notes, attachments) are ever transmitted to us or to anyone else, in any form, unless you explicitly enable sync — and even then only as ciphertext we cannot decrypt.
- No data is sold, rented, or shared with data brokers or advertisers. There is nothing of that kind to share in the first place.
- No account or email address is required to use the app locally. Buying a plan on the website is optional and happens in Stripe Checkout, not inside the vault.
How your data is protected
Your encryption key is derived on-device using PBKDF2-HMAC-SHA-256 with 600,000 iterations, generated as a non-extractable key by the browser/OS's own cryptography engine. The app itself has no code path that can export or transmit it.
Every vault entry is encrypted with AES-256-GCM before it touches local storage. Nothing is ever written to disk in plain text.
If you enable fingerprint or face unlock, the app only receives a yes/no result from your operating system's own biometric hardware. We never receive, see, or store any biometric data ourselves.
If you use the camera to scan a document into a vault entry, text recognition happens locally on your device. The image and any recognized text are encrypted the same as any other entry and are never uploaded for processing.
Multi-device sync is off by default. If you turn it on, the relay infrastructure that moves your data between your own devices only ever sees already-encrypted ciphertext — the decryption key is never sent to it.
Deleting an entry or your entire vault removes it from your device immediately. If sync is enabled, the deletion propagates to your other synced devices; we hold no separate copy to delete on our end because we never held a readable copy in the first place.
Information we do receive
A small amount of information reaches us indirectly, not from the app's own code, but from the infrastructure any app necessarily runs on top of:
- App store platforms (Google Play, Apple App Store) may share aggregate install counts, crash statistics, or payment status with us as the developer, under their own respective privacy policies — this happens whether or not you interact with the app itself.
- App-store in-app purchases (when those listings exist) are processed by the store's own billing system. We receive confirmation that an entitlement was purchased, not your payment card details, which we never see.
- Website Stripe Checkout is the self-serve path on this marketing site today. Stripe hosts the payment form. We do not store card PAN. The Checkout session may include the email address you give Stripe, which the Worker uses only for trial-abuse checks and voucher issuance. The product of a successful payment is a signed license voucher (an entitlement envelope), not vault contents and not a vault identity. You import that JSON in Settings → License & Membership on your own device.
- Optional sync relay metadata, if you enable sync: the relay needs to know which encrypted blobs belong to which of your own devices in order to route them, which is connection-level metadata (timestamps, device identifiers you control), never vault content.
Your rights
Because your vault data lives only on your own device (and, if you choose, in encrypted form on your other synced devices), most data-subject rights under GDPR, CCPA, and similar laws are already satisfied by the app's design rather than by a request to us:
- Access and portability — open the app; everything is already there and exportable from within it.
- Deletion — delete an entry or uninstall the app; there is no separate server-side copy for us to erase.
- Correction — edit any entry directly in the app at any time.
If you have a question we haven't answered here, or a request that isn't covered by the above (for example, about app-store-level account data), contact us at [support email to be added].
Children's privacy
Cryo Dungeon Enclave is not directed to children and is not knowingly used by children under the age set by applicable local law (13 in the US under COPPA; higher in some other jurisdictions). We do not knowingly collect information from children, and given the app's local-only architecture, there is generally no personal data of any kind for us to hold regardless of the user's age.
Changes to this policy
If this policy changes in a way that materially affects what data the app collects or how it's used, we'll update the effective date above and, where required by law, notify you in-app before the change takes effect.
This is a draft for internal review, not a published legal document. It has not been reviewed by an attorney, no effective date has been set, and no live URL has been submitted to any app store console yet.