Privacy Policy

Cloister · Effective 22 October 2026

Tom Plaes ("we") operates Cloister (the "app"). This page explains what the app does with your data.

1. Data stored on your iPhone

Items you add to the vault are copied into the app's private storage and encrypted. The vault also keeps an encrypted index of item names, types, sizes, dates and album names. The content of your items and this index cannot be read without your PIN and the app's keys.

Some information is not hidden. Anyone who can read the app's files, including from a device backup, can see how many items the vault holds, the approximate or exact size of each item, whether an item has a preview image (which shows photos and videos apart from PDFs), when files were last changed, and a small plain-text file that records that the folder is a vault and when it was created. They cannot read names, albums or content from that.

Each file is encrypted with AES-256-GCM. Your PIN, combined with a secret stored in the iPhone Keychain that never leaves this device, protects the key that unlocks the vault. Face ID or Touch ID is an optional second way to unlock the same vault. Your PIN always works.

While the vault is unlocked, the app asks the operating system to block screenshots and screen recordings and to hide its contents in the app switcher, and it covers its own window whenever it is not in the foreground. These protections depend on the operating system and do not stop a camera pointed at the screen. No security measure protects against every scenario. A compromised or jailbroken iPhone, or anyone who knows your PIN, can reach your files.

While you add a file, the system picker first makes a temporary unencrypted copy inside the app. The app deletes it after each file and clears any that are left over when it starts and each time you unlock. While you view or export an item, a temporary unencrypted copy exists in the app's cache until you close the viewer or the vault locks.

No recovery key. Your PIN cannot be reset or recovered by us. If you forget your PIN and Face ID or Touch ID is not set up, the vault cannot be opened and its contents are lost permanently. The same applies if the vault is restored to a different iPhone, because the key does not leave the original iPhone.

2. Data we do not collect

The app has no server and no backend. We do not receive your photos, videos, PDFs, file names, metadata, PIN or biometric data. Face ID and Touch ID data never reach the app; iOS only reports whether the check succeeded.

3. Purchases

Premium is sold through Apple In-App Purchase, and Apple processes your payment. The app uses RevenueCat to check your purchase and subscription status. RevenueCat receives purchase identifiers and transaction status. It does not receive your files. RevenueCat keeps a record of these purchases, under an anonymous ID that is not linked to you, to validate them and to give us overall sales figures. Read the RevenueCat privacy policy and the Apple privacy policy.

4. Exports

When you export an item or your whole vault, the app writes unencrypted copies to a folder you choose, such as a folder in Files. The app does not control those copies. Anyone who can open that folder can open them. Keep exported copies as safe as you keep the originals.

5. Deleting data

Deleting an item removes its encrypted copy from the vault on this iPhone. Erasing the vault removes every encrypted file, album and key the app stores. Deleting the app deletes the vault and its files. The app never changes or deletes the originals in Photos or Files.

Deleting does not reach backups. An iCloud or computer backup made before you deleted an item still contains that item's encrypted copy. If you restore such a backup onto the same iPhone, the deleted item can come back. To remove an item from older backups, delete those backups yourself.

6. Backups, sync and new iPhones

This version has no cloud backup and no sync between devices of its own. On iPhone, the vault files are not excluded from iCloud or computer backups, so a backup of your iPhone includes the encrypted vault files and the information listed in section 1 that is not hidden. The key stays on the original iPhone, so the vault cannot be opened on another iPhone after a restore, and its contents are permanently unreadable there. Export your files before you change phones.

On Android, the app opts out of Android backup, so the vault files are not sent to Google Drive or copied to a new phone.

7. Analytics, ads and tracking

This version contains no analytics, advertising or tracking SDKs. We do not track you across other apps or websites.

8. Children

Cloister is not directed at children under 13. We do not knowingly collect personal information from children.

9. Contact

For questions or requests about this policy, email plaes.dev@gmail.com. The operator is Tom Plaes.

10. This website

This website is a static site. It sets no cookies and uses no analytics, advertising or scripts. Our hosting provider (Cloudflare) may process technical request data, such as your IP address, to deliver pages and protect the site. We do not receive your files, and the app does not send them to the website.

11. Changes

If we change this policy, we will post the new version on this page and update the effective date at the top.