Privacy Policy
Effective July 12, 2026 · Sanctum for iOS
The short version
Sanctum collects nothing. There is no account, no server, no analytics SDK, and no tracking of any kind. Everything you put in Sanctum — photos, videos, notes, browsing — is encrypted with AES-256-GCM and stored only on your device.
Data we collect
None. Sanctum has no backend. Your media, notes, passcodes (stored only as salted hashes), break-in records, and settings never leave your iPhone. We cannot see, access, or recover your content — the encryption keys exist only on your device.
Photos & camera
Photo library access is only used when you import media (via Apple's out-of-process picker, which shares only the items you select) or when you explicitly export or delete originals. Camera access is used for the Private Camera and — only if you enable Break-In Alerts — to photograph failed passcode attempts. These photos stay encrypted on your device.
Face ID
Biometric unlock is handled entirely by iOS. Sanctum never sees your biometric data — Apple's LocalAuthentication framework simply tells the app whether authentication succeeded.
Private Browser
The built-in browser uses a non-persistent session: history, cookies, and cache are held in memory and destroyed when the vault locks. Sanctum does not log, proxy, or inspect your browsing. Requests go directly from your device to the sites you visit.
Backups
Your encrypted vault is included in your device's standard iCloud or computer backup, still encrypted. Restoring a backup restores your vault; your passcode unwraps the keys. Apple's backup handling is governed by Apple's privacy policy.
Children
Sanctum is not directed at children under 13 and collects no data from anyone, of any age.
Changes & contact
If this policy ever changes, the update will be posted at this page with a new effective date. Questions: gomarcinai@gmail.com.