DuoVault Privacy Policy

1. Personal information collected

The Company collects the following information to provide the Service.

Email address: when you sign in with a Google account, the email address Google provides is stored in the authentication record (Firebase Authentication). Signing in with an Apple account also requests an email address. If you choose Apple's 'Hide My Email', a relay address created by Apple is stored instead of your real address. The email address is used only to stop one person's account from splitting in two when they sign in with Apple and Google separately, and to reconnect them to their existing vault. It is never used for advertising or marketing email. This value is not shown anywhere in the app and is not part of the public profile shared with your partner.

Signing in on Android: Google sign-in uses the device's Google account picker (Android Credential Manager), and Sign in with Apple opens Apple's web sign-in in a browser tab (Custom Tab). We receive the same sign-in information listed above.

Diagnostics and crash reports: only the values in the table above are transmitted, in order to identify why a photo fails to open and why the app terminates abnormally. Crash reports are processed by Google (Firebase Crashlytics). No value that could be linked to a photo — file name, file content, album name, or capture information — is included. You can review exactly what is sent, and turn transmission off, in Settings › Vault health check in the app.

Usage stages: records how far you have progressed after starting to use the app, one timestamp per stage, for the first time only. Which buttons you pressed, what you stored, and how often you use the app are not collected. This has nothing to do with the content or file information of photos and videos. It follows the same switch as the diagnostics above, and stops when you turn transmission off in Settings › Vault health check in the app.

Ad attribution (from November 22, 2026): the app receives a one-time token from Apple's AdServices framework and sends it to our server, which asks Apple with that token and stores only whether the app was installed through an Apple Search Ads ad and that ad's details. We do not use the advertising identifier (IDFA), we do not track your activity across other companies' apps or websites, and we do not use this for personalized ads. The install identifier is a random value created for each installation, separate from your account; it is attached to App Store purchases only to count which ads led to subscriptions. This follows the same switch as diagnostics and is not sent if you turn transmission off in Settings › Vault Health Check. Ad attribution is collected only by the iPhone app; the Android app does not collect it.

Subscription status history (from November 22, 2026): our server records only the values in the table above from the subscription notices the App Store sends us (App Store Server Notifications), after confirming them with Apple's servers. Payment details such as card numbers are managed by Apple and never reach us.

Google Play billing (Android app, from November 22, 2026): when you subscribe in the Android app, and when the app checks your subscription again (opening the subscription screen, restoring purchases and so on), the app sends our server the purchase token issued by Google Play and the product ID. Our server uses the token to ask Google (Google Play Developer API) for the subscription status and expiry time, then applies Premium. When a subscription renews, is canceled or is refunded, we receive Google Play's notice (Real-time developer notifications) and check again the same way. We keep the purchase token linked to your account (UID) so that the same purchase cannot be used by another account. Payment details such as card numbers are managed by Google and never reach us. Google Play's notices are used only to keep your subscription status up to date and are not recorded as subscription status history.

Genuine-app check (Android app, from November 22, 2026): when the Android app connects to our servers (Firebase), Firebase App Check confirms that it is the genuine app. Google Play services on the device creates an integrity token (Play Integrity) from app information (package name, version, signing certificate), whether a Google account on the device holds a license for the app, and device integrity information, and Google checks it. Google processes this check under the Google Play Terms of Service; we do not store the token or the verdict. Your photos, videos and account information are not sent for this check.

Information that stays on your device: the break-in log (the time a wrong vault passcode was entered and, if you turned it on, a front-camera photo taken at that moment) and encrypted backup files stay on your device or in the location you choose, and are never sent to the Company. The camera is used only if you turn on photos for the break-in log.

App passphrases and encryption master keys are never collected; they stay only on your device (protected by the Keychain on iPhone and the Keystore on Android). Photos and videos are stored and transmitted as encrypted ciphertext only, so the Company cannot read their contents.

2. Purpose of processing

Collected personal information is not used for purposes other than the following.

1. Couple vault account sync and partner linking
2. Providing features such as view history
3. Providing the Premium subscription and determining benefits
4. Service operation, security (genuine-app checks, preventing misuse of purchases), customer support, troubleshooting, and stability improvements
5. Measuring ad effectiveness and understanding why subscriptions end (from November 22, 2026)

3. Processors and third-party provision

The Company entrusts the following processing to provide the Service.

Sign in with Apple, App Store payment and subscription management, Google Sign-In, and Google Play billing and subscription management are features you use directly with Apple or Google and are handled under their privacy policies. The Company processes only the resulting user identifier, display name, email (Section 1) and transaction identifiers (App Store transaction identifiers, Google Play purchase tokens). From November 22, 2026, we also receive ad attribution from Apple (AdServices) and subscription status history from Apple (App Store Server Notifications). For the attribution lookup we send Apple only the token the app received from Apple, and provide no other information to Apple. From the same date, to confirm Android purchases we send Google only the purchase token issued by Google Play.

Except where consent has been obtained under applicable law or where required by law, the Company does not provide personal information to third parties. As an essential function of the Service, your connected partner receives your display name, public key, subscription status, and the items you add to the couple vault (encrypted, and opened only on their device).

3-2. Transfer of personal information abroad

Couple vault photos and videos (ciphertext), thumbnails, account, subscription (including Google Play purchase tokens) and usage records, and ad attribution are stored in Seoul, Republic of Korea (Google Cloud asia-northeast3) and are not transferred abroad. The following information, however, is processed on the processor's systems outside Korea.

Legal basis: Article 28-8(1)(iii)(a) of the Korean Personal Information Protection Act — entrustment and storage necessary to perform our contract with you, disclosed in this Policy.

4. Retention and destruction

1. Personal vault data is kept only on the user's device and is not stored on servers.
2. Couple vault data (ciphertext and thumbnails on the server) is deleted under Section 6-2 of the Terms seven days after Breakup Mode starts (or when the owner's postponement ends; from November 11, 2026, nothing is deleted when the non-owner starts it — the data stays with the owner), and without delay when the account or couple vault is deleted. Deletion runs in a cleanup job once a day.
3. Account information (including payment and subscription information and the Android app's Google Play purchase tokens) is kept until the account is deleted; crash reports are kept for 90 days after collection.
4. Ad attribution is kept for 1 year and subscription status history for 2 years after collection, then deleted in the daily cleanup job (from November 22, 2026).
5. Except where retention is required, the Company destroys personal information without delay once the processing purpose is achieved. Electronic files on the server are deleted in a way that cannot be recovered.

5. Your rights and how to exercise them

1. You can ask at any time to access, correct, delete, or suspend the processing of your personal information. You can delete it yourself with "Reset app (delete everything)" or by deleting your account (Settings → Account → Delete Account), stop using the Service by signing out, and make other requests using the details on the Support page. You can also request account deletion by email without the app; the steps and what is deleted are on the account deletion page. The Company acts without delay.
2. Limits from encryption: Photos and videos are encrypted on your device and the Company cannot decrypt them; what the Company processes is account information and ciphertext whose content it cannot know. The Company therefore cannot act on access, correction, or selective deletion requests based on what a photo or video shows. You can exercise these rights by deleting items yourself in the app.
3. Shared photos: A couple vault photo may show both connected people. Deletion of items uploaded by your partner and the behavior of Breakup Mode follow Section 6-2 of the Terms, and the Company cannot delete copies your partner saved separately on their own device.
4. Ad attribution: it is stored under a random install identifier rather than your account, so the Company cannot readily pick out a particular person's record. If you do not want it sent, turn off diagnostics in Settings › Vault Health Check; reinstalling the app creates a new identifier that is not linked to earlier records.

5-2. Sensitive information

The Company does not collect sensitive information. Photos and videos you upload may contain sensitive content, but the Company keeps them only as ciphertext it cannot read and does not use or analyze their content.

6. Security measures

The Company applies technical and administrative safeguards including end-to-end encryption (E2E), key management based on the device's secure storage (Keychain on iPhone, Keystore on Android), genuine-app checks (Firebase App Check), and least-privilege server access control. Note that, given the nature of the encryption, data cannot be recovered if the passphrase is lost.

7. Children's privacy

This Service is not directed at children under 14 and does not collect their personal information.

8. Privacy officer

For questions, complaints, or remedies regarding personal information, contact:

• Privacy officer: Cho Seungkyu
• Email: [email protected]
• Company: XTI Co., Ltd. · Business registration no. 362-87-03342
• Address: 2F, 94 Yangcheon-ro, Gangseo-gu, Seoul 07604, Republic of Korea

8-2. Remedies

For reports or advice about infringement of personal information, you can contact the following Korean bodies.

• Personal Information Dispute Mediation Committee: www.kopico.go.kr · +82-1833-6972
• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr · 118
• Supreme Prosecutors' Office: www.spo.go.kr · 1301
• Korean National Police Agency: ecrm.police.go.kr · 182

9. Notice of changes

If this Policy changes, the effective date and reason will be announced in the Service or through this document from seven days before the effective date. Changes that significantly affect your rights, such as collecting more data, will be announced 30 days in advance and also notified separately, such as through an in-app notice.

Revision history

• Announced October 23, 2026 · effective November 22, 2026 — Added ad attribution (Apple Search Ads), subscription status history, and the time a free trial started as a usage stage to the data we collect (Section 1), and stated the purpose (2), where we receive it from (3), where it is stored (3-2), how long it is kept (4: ad attribution 1 year, subscription status history 2 years), and how to refuse (5). Because this expands what is collected, it is announced 30 days before the effective date under Section 9 and also notified separately in the app, and the collection starts on the effective date. We also stated that the break-in log and encrypted backup files in app version 1.3.0 stay on the device and are never sent to the Company (Section 1, effective immediately). Ahead of the Android release, we also added Google Play billing information (purchase token, product ID, subscription status) and the platform and app version recorded by the Android app to the data we collect (Section 1), genuine-app checks and preventing misuse of purchases to the purposes (2), Google LLC (Google Play) purchase confirmation, notice delivery and integrity verdicts (Play Integrity) to the entrusted work (3), the related processing abroad to Section 3-2, the retention of purchase tokens to Section 4, and Android key storage (Keystore) and genuine-app checks to Section 6. These Android items take effect on the same date (November 22, 2026). We also listed the genuine-app check (Firebase App Check) the iPhone app already uses (no change in what is collected).
• Revised October 7, 2026 · effective immediately — Following legal advice, we described processing we already do more precisely: processors are listed in a table, and we added sections on transfer abroad (3-2), sensitive information (5-2) and remedies (8-2), and stated when data is kept and destroyed, the limits encryption places on exercising your rights, and the privacy officer's name. The notice period for significant changes is now 30 days. Nothing collected or the scope of use was expanded.
• Revised September 25, 2026 · effective October 2, 2026 — Apple sign-in now also requests an email address, to stop one person's account from splitting in two when they switch sign-in methods and to reconnect them to their existing vault. Because this expands what is collected, it takes effect seven days after this notice under Section 9, and the collection begins with app versions released on or after that date.
• Revised September 10, 2026 · effective September 17, 2026 — Added usage stages as collected data and stated that crash reports include reason codes of handled errors. The English text of this revision was published late, on September 25, 2026; the Korean text has applied since September 17, 2026.
• Revised September 8, 2026 · effective September 15, 2026 — Added diagnostics and crash reports as collected data, to improve app stability. Because this expands what is collected, it takes effect seven days after this notice under Section 9, and the collection begins with app versions released on or after that date.
• Revised September 8, 2026 · effective immediately — Added the email address stored when signing in with a Google account, which had been omitted from the list of collected data. This does not widen what is collected; it corrects the description of collection that was already taking place.
• Revised September 8, 2026 · effective immediately — Removed the collected items relating to the discontinued reactions feature. This narrows what is collected.
• August 16, 2026 — Initial version.