English · Türkçe
Privacy Policy for VaultShare
VaultShare (“the app”, “we”, “us”) is an end-to-end encrypted, peer-to-peer file-sharing application. This policy explains what information the app does and does not handle. The short version: VaultShare does not collect, store, sell, or share your personal data, and your files never pass through our servers.
1. No accounts, no tracking
- VaultShare has no user accounts, logins, or registration.
- We do not include any analytics, advertising, tracking, or profiling SDKs.
- We do not collect your name, email, phone number, contacts, location, or device identifiers.
2. Your files
Files you send are transferred directly between the two devices over an encrypted WebRTC data channel. Specifically:
- A shared session key is derived on-device using an ECDH (P-256) key exchange and HKDF-SHA256.
- Every file is split into chunks; each chunk is encrypted with AES-GCM-256 and verified with a SHA-256 checksum on arrival.
- File contents are never uploaded to, processed by, or stored on any server we operate. They exist only on the sending device, the receiving device, and in transit (encrypted) between them.
- We have no ability to access, recover, or decrypt your files.
The optional secure chat works the same way: messages are encrypted on your device, sent directly to the other peer over the same encrypted channel, and are never stored on or seen by any server we operate. We cannot read them.
3. The signaling server
To let two devices discover each other, the app connects to a signaling server (a lightweight relay) chosen by you or your distributor. The signaling server:
- Helps the two peers exchange the information needed to open a direct connection (channel code and public connection details, including each peer’s public ECDH key and network candidates).
- Never receives your file contents and never receives your private keys or the derived session key.
- Necessarily observes the IP address of connecting devices and the short-lived channel code, as is technically required to route the connection. This connection metadata is used only to establish the session and is not used by us to identify or profile you.
If you point the app at a self-hosted signaling server, that server is operated by you (or whoever runs it), and its handling of connection metadata is governed by that operator.
4. STUN / TURN (NAT traversal)
To establish a direct connection across different networks, the app uses public STUN servers (e.g. Google’s public STUN service). A STUN server learns the device’s public IP address in order to help peers find a network path. It does not receive file contents or encryption keys.
When a direct peer-to-peer path cannot be established (for example, on restrictive or carrier-grade NAT networks), the app may fall back to a TURN relay server that we operate, which forwards the connection between the two peers. Because the traffic is already end-to-end encrypted, the relay only ever sees ciphertext — it relays your public IP address and the encrypted packets, and never has access to your encryption keys, file contents, or chat messages. The public STUN servers are operated by third parties under their own privacy policies; the TURN relay is operated by us and processes only the encrypted connection metadata described above.
5. Camera & permissions
- Camera — your browser requests camera access only when you choose to scan a channel QR code. The camera image is processed in your browser, in real time, solely to read the code; no photos or video are recorded, stored, or transmitted. You can deny or revoke this at any time in your browser’s site settings.
- Microphone — VaultShare never requests or uses your microphone.
The app reads your browser/device language locally to display its interface in your preferred language; this is not transmitted anywhere. Received files are saved through your browser’s normal download to the location you choose.
6. Data sharing and sale
We do not sell, rent, or share any personal data with third parties, because we do not collect any. There is no advertising network, data broker, or analytics provider involved.
7. Children’s privacy
VaultShare is a general-purpose utility and is not directed at children. We do not knowingly collect any information from anyone, including children.
8. Security
VaultShare is designed so that confidentiality does not depend on trusting us. End-to-end encryption keys are generated and held only on the participating devices, and a security verification code is shown on both screens so users can confirm there is no man-in-the-middle before any file is transferred. No system is perfectly secure, but by design we never hold the data or keys that would let us — or an attacker compromising our infrastructure — read your files.
9. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, within the app or its store listing.
10. Contact
- Email: orhanp@gmail.com
- Website: https://www.orhanpolat.com