Every photo and video is encrypted on your device before it is stored, and the keys never leave your devices. If you turn on the optional iCloud sync, only encrypted data goes to your private iCloud; neither Apple nor we can see the contents. No account, no server of ours, no advertising, no tracking.

The app does not need an account, and we do not run any servers for it. The app contains no advertising, no tracking, and no analytics.

All photos and videos you bring into the app, their thumbnails, and their metadata (e.g., capture date, location, file name, album and tag names) are encrypted on your device before they are stored. Each item has its own key. The keys are protected by your password, the Secure Enclave of your device, optionally Face ID, and your Magic Code. We never have access to them.

The app only reads the photos and videos you select for import; limited access is sufficient. If you choose to delete the originals from the Photos app after import, iOS asks for your confirmation first.

With the camera in the app, you take photos and videos directly into the vault. The recording stays in memory and is encrypted before it is stored; nothing is saved to the Photos app. The app does not request your location. It uses the microphone only in video mode. The app asks for camera and microphone access the first time; you can revoke it at any time in the iOS settings.

If you share photos or videos with Opaq from another app, the share extension encrypts them right away with a key stored on your device and keeps them, encrypted, in a storage area on your device that only Opaq can access, until you next unlock the app. If the other app cannot provide a video in place, iOS creates a temporary copy, which the extension deletes immediately after encrypting it. The originals remain in the other app.

iCloud sync is off by default. If you turn it on (during setup or at any time in the settings), the app stores your vault in your private iCloud database (Apple CloudKit). Only encrypted content is transmitted: photos, videos, thumbnails, and metadata are encrypted on your device beforehand. So that one password works on all your devices, the app also stores a derived form of your password there, encrypted with your vault key, as well as an optional separate password for "Hidden" and a public key for each of your devices. Your password itself is stored nowhere. Apple, as the provider of iCloud, can see technical information such as the number and size of the stored records and the times of changes, but not their contents. We have no access to your iCloud data. Apple's privacy policy applies to the processing by Apple.

Without iCloud sync, no photos, videos, or metadata leave your device. Only the key that can be opened solely with your Magic Code is always stored in your private iCloud, encrypted, as long as you are signed in to iCloud. This way, a new Magic Code applies on all your devices.

With Online Mode (optional, per device), the originals are stored only in your private iCloud. To display one, the app downloads it temporarily in encrypted form and deletes this copy when you leave it or lock the app.

If you turn on Face ID or Touch ID, iOS handles the check entirely. The app only learns whether the check was successful and has no access to your biometric data.

Photos and videos only leave the vault if you explicitly confirm an export, either to the Photos app or via the share sheet. After that, they are stored unencrypted at the chosen destination and are no longer protected by the app. By default, the location is removed on export. The same applies to the deletion receipt you can share after deleting an album with its contents: it shows the album name, the number of items, the time, and thumbnails blurred down to outlines, and leaves the app only if you share it.

The location of a photo is shown on a map only after you explicitly confirm it. The coordinates are then passed to Apple Maps; Apple's privacy policy applies.

If you write to us from the app, your mail app opens with the app version in the subject line. We only use your message and e-mail address to answer your request.

You get the app through the Apple App Store. Apple is responsible for download, payment, and updates; we have no access to that data. Apple's privacy policy applies: https://www.apple.com/legal/privacy/

If you have turned on "Share with App Developers" in the iOS settings, Apple provides us with anonymous crash reports and usage statistics. They do not identify you.

Whatever happens only on your device or in your private iCloud does not reach us; we do not process that data.

If you e-mail us, we process your address and message to answer you (Art. 6(1)(b) GDPR for questions about a purchase, otherwise Art. 6(1)(f) GDPR).

What the app stores on your device stays there until you delete it in the app or remove the app. Data in your iCloud can be deleted in your device's iCloud settings.

We delete e-mails to us once your request has been resolved, unless statutory retention obligations apply.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Since we do not keep accounts and the app does not identify you, we often cannot attribute data to a person (Art. 11 GDPR). Write to us anyway; we are happy to help.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: the data protection authority of Lower Saxony (LfD Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, https://www.lfd.niedersachsen.de

Nikita Aurelian Schulz (PODSchu). The full address is in the legal notice (Impressum) on this page.

For questions about data protection: contact.schulzpod@gmail.com