Privacy policy

Effective 14 November 2026

What stays on your phone

• Your documents, their titles, categories, notes and the text read from scans. Text is read on the phone with Apple's on-device recognition; the pictures are not sent anywhere to be read.
• The keys that open your vault, kept in the phone's secure storage.
• Expiry reminders. They are planned and shown by your phone. Our server is not told which documents you have or when they expire.

What our server holds

To keep your devices in sync and to share links, the service stores:

• Your documents as encrypted data that we cannot decrypt, with its size and the time it changed.
• The public keys of your devices, and a name for each device that you can see in the app.
• A one-way fingerprint of your Apple account identifier (computed with a secret held by the service), so we can check that someone restoring your vault holds the right Apple ID. We do not store your Apple ID, your name or your email address.
• For each shared link: the encrypted copy, when it expires, the view limit, how many times it was opened, and whether it was revoked. We do not hold the key in the link or the access code.
• Technical data needed to run and protect the service, such as request times and network addresses, used for rate limiting and abuse prevention.

Sign in with Apple

Restoring your vault needs both your recovery phrase and your Apple account. Apple handles that sign-in under its own privacy policy. We receive a token from Apple that proves which account signed in, and we keep only the fingerprint described above.

Shared links

A link contains a key after the # sign. Browsers do not send that part to servers, so we never receive it. The recipient's browser fetches the encrypted copy from us and decrypts it on the recipient's device. If you add an access code, it is combined with the key and is never sent to us. When a link expires, runs out of views or is revoked, the service stops serving it.

What we do not do

• We do not sell or share your data, and we do not show advertising.
• The app contains no analytics or tracking software.
• This website sets no cookies and uses no analytics.

Who else is involved

• Apple provides Sign in with Apple, on-device text recognition and notifications scheduling on your phone.
• Cloudflare hosts the service and this website. It processes the encrypted data and network requests on our behalf.

Keeping and deleting data

Deleting a document in the app removes it from your devices and from the service, and revokes the links made from it. Encrypted copies are removed from storage after a short delay. To have your whole vault removed, write to us at the address below.

Security and its limits

Because only you hold the keys, we cannot recover your documents if you lose both your devices and your recovery phrase, and we cannot reset the phrase. A link and its access code are only as private as the way you send them. A recipient can photograph their screen, and if you allow downloads they keep the copy they save.

Children

DocuLock is not directed to children under 13, and we do not knowingly collect their information.

Changes to this policy

If we change this policy in a way that matters, we will update the date above and tell you in the app.

Contact

Questions or requests about your data: support@doculock.app.