CLEAR BY DESIGN
Your privacy.
In plain language.
Sanctum is built so that we never receive your photos, videos, documents, notes, patterns, recovery codes or encryption keys. This policy explains the little data that does exist and where it goes.
1. Who we are
Sanctum is published by Abdilatif Isaaq (“we”). For privacy questions or requests, email support@sanctum.superapp.now.
2. Your vault stays encrypted on your iPhone
Everything you add to Sanctum is encrypted on your iPhone with AES-256-GCM before it is stored, including thumbnails, titles and albums. Your pattern and recovery code unlock the keys on your iPhone and are never stored or sent anywhere. There is no Sanctum account, and we operate no server that receives vault content or keys. We cannot see, recover or reset your vault.
3. Private Backup to iCloud
Private Backup is on by default for your first vault and can be turned off per vault in Settings. Sanctum encrypts the vault on your iPhone and saves one encrypted backup file in your own iCloud Drive (folder “Sanctum”). Apple stores that file under your Apple Account and its own privacy terms; neither Apple nor we can read it, because opening it requires that vault’s recovery code. You can delete the file in the Files app at any time. If you save a backup file elsewhere yourself, the service you choose handles it under its own terms.
4. Photos, camera and microphone access
Imports use Apple’s photo and file pickers, which give Sanctum only the items you select. Sanctum asks for Photos access only when you choose to delete originals after an import, and for camera and microphone access only when you use the private camera. Nothing captured or imported leaves your iPhone except inside your encrypted backup or a share you create.
5. Encrypted sharing
A share is an encrypted file that you send yourself, by AirDrop, Messages or any other app. We never receive it. It opens only with the one-time code Sanctum shows you, which you send separately.
6. Purchases
Payments are handled by Apple. To unlock Pro on your devices we use RevenueCat, which receives an anonymous app user ID, your purchase history and basic device information (such as iOS version and storefront country). It never receives vault content. See RevenueCat’s privacy policy at revenuecat.com/privacy. We do not link purchase data to your identity.
7. No tracking, ads or analytics
Sanctum contains no advertising, no third-party analytics and no tracking across apps or websites. Apple may share crash reports with us only if you allow it in iOS Settings.
8. This website
This website sets no tracking cookies and runs no analytics. Our hosting provider may keep standard server logs, such as IP address and pages requested, for security and reliability.
9. Retention, deletion and your rights
Deleting Sanctum removes the vaults on your iPhone. Delete your iCloud backup files in the Files app. Because we hold no personal data beyond what RevenueCat processes for purchases, most requests can be completed on your device; for anything else, including access or deletion requests under UK GDPR or other laws, email us. Sanctum is not directed at children under 13.
10. Changes
If this policy changes, we will update this page and its effective date. Material changes will also be described in the app’s release notes.