DuoVault
한국어
DuoVault Privacy Policy
Last updated: September 8, 2026
XTI Co.,Ltd. (주식회사 엑스티아이, the "Company") takes users' personal information very seriously and complies with applicable laws, including the Personal Information Protection Act of Korea.
1. Personal information collected
The Company collects the following information to provide the Service.
| Category | Items collected | Purpose |
|---|---|---|
| Sign-in information | Apple/Google account user identifier (UID), display name, email address (Google sign-in only) | Account identification, couple vault sync and partner identification |
| Couple vault data | Encrypted photos and videos (ciphertext), thumbnails, upload metadata | Couple vault sync |
| Usage records | Item view history | Providing the view history feature |
| Public profile | Public key (for key exchange), display name, subscription status | Partner linking and sharing Premium benefits |
| Payment and subscription | App Store transaction identifiers, subscription status | Providing the Premium subscription |
| Diagnostics | App version, device model, iOS version, vault item count and storage used, the number of items that failed to open and their reason codes | Identifying the cause of file errors and improving the Service |
| Crash reports | Execution information at the moment the app terminated abnormally (crash location, app / device / OS version) | Identifying causes of errors and improving stability |
Email address: when you sign in with a Google account, the email address Google provides is stored in the authentication record (Firebase Authentication). Signing in with an Apple account does not request an email address, so none is stored. This value is not shown anywhere in the app and is not part of the public profile shared with your partner.
Diagnostics and crash reports: only the values in the table above are transmitted, in order to identify why a photo fails to open and why the app terminates abnormally. Crash reports are processed by Google (Firebase Crashlytics). No value that could be linked to a photo — file name, file content, album name, or capture information — is included. You can review exactly what is sent, and turn transmission off, in Settings › Vault health check in the app.
App passphrases and encryption master keys are never collected; they are stored only in the user's device Keychain. Photos and videos are stored and transmitted as encrypted ciphertext only, so the Company cannot read their contents.
2. Purpose of processing
Collected personal information is not used for purposes other than the following.
- Couple vault account sync and partner linking
- Providing features such as view history
- Providing the Premium subscription and determining benefits
- Service operation, customer support, troubleshooting, and stability improvements
3. Third-party provision and processing
The following third parties are used to provide the Service.
- Apple: Sign in with Apple, App Store In-App Purchase
- Google (Firebase): Authentication, Firestore database, Storage, Cloud Functions, Crashlytics (crash reports)
- Google Sign-In: Google account authentication
Except where consent has been obtained under applicable law or where required by law, the Company does not provide personal information to third parties for purposes beyond those above.
4. Retention and destruction
- Personal vault data is kept only on the user's device and is not stored on servers.
- Couple vault data is deleted automatically when the user deletes their account or when the breakup mode grace period (7 days) elapses.
- Except where retention is required, the Company destroys personal information without delay once the processing purpose is achieved.
5. User rights
You can request deletion of your data at any time through "Reset app (delete everything)" in the app or by deleting your account, and you can stop using the Service by signing out. For access, correction, or deletion requests, contact us using the details on the Support page.
6. Security measures
The Company applies technical and administrative safeguards including end-to-end encryption (E2E), device Keychain-based key management, and least-privilege server access control. Note that, given the nature of the encryption, data cannot be recovered if the passphrase is lost.
7. Children's privacy
This Service is not directed at children under 14 and does not collect their personal information.
8. Privacy contact
- Contact: XTI Co.,Ltd. Customer Support
- Email: [email protected]
9. Notice of changes
If this Policy changes, the effective date and reason will be announced in the Service or through this document from seven days before the effective date.
Revision history
- Revised September 8, 2026 · effective September 15, 2026 — Added diagnostics and crash reports as collected data, to improve app stability. Because this expands what is collected, it takes effect seven days after this notice under Section 9, and the collection begins with app versions released on or after that date.
- Revised September 8, 2026 · effective immediately — Added the email address stored when signing in with a Google account, which had been omitted from the list of collected data. This does not widen what is collected; it corrects the description of collection that was already taking place.
- Revised September 8, 2026 · effective immediately — Removed the collected items relating to the discontinued reactions feature. This narrows what is collected.
- August 16, 2026 — Initial version.