Vailuna

Privacy Policy

Last updated: September 18, 2026

Vailuna, provided by Yayun Liu, is a locally encrypted file vault. We do not host your plaintext vault or hold its decryption keys. This does not mean the app never connects to the network. Optional sync, maps, subscriptions, desktop activation and other features involve the processing described below.

1. Your vault and local processing

File contents, names and vault directory metadata are encrypted on-device before storage or sync. The master password protects keys; biometrics are verified by the operating system to authorize local access. The app does not obtain face or fingerprint templates. Photo optimization, thumbnail generation and visual search run on-device. Optional model downloads contact distribution services but do not upload search images.

Vault decryption primarily happens in memory. Imports, incoming system shares, exports and outgoing shares may temporarily place plaintext in system or app-private temporary storage. The app removes temporary copies it manages during the relevant workflow or subsequent cleanup. Copies you save externally or hand to other apps are managed by you and the recipient.

2. Your own cloud

Sync sends encrypted files and metadata to your chosen iCloud, Dropbox, Google Drive, WebDAV, S3 or sync folder. Providers may see your account, connection IP, timing, ciphertext sizes and object identifiers, while vault contents and filenames remain encrypted. Providers process account and service data under their own policies.

iCloud uses your system Apple Account. Dropbox and Google Drive use their official authorization flows. Dropbox access uses an app-specific folder; Google Drive uses the hidden appDataFolder, without requesting access to other Drive files. Authorization information is stored on-device. If you confirm transferring sync settings to a desktop, necessary settings travel through an end-to-end encrypted pairing channel.

3. Maps and optional location

  • Place search sends your typed query to Apple’s map services.
  • Photo maps and detail panels request the surrounding map area. Opening location details may automatically send precise capture coordinates to Apple for reverse-geocoded addresses. These displays degrade when offline or unavailable.
  • Recording location for in-app photography is off by default. After your consent and system permission, the app obtains a one-time location while in use and records it in encrypted vault metadata; it does not continuously track you in the background. Later map display follows the behavior above.

Photo contents are not sent with map requests. You can avoid map features and disable capture location in the app or system permissions.

4. Subscriptions and desktop activation

Apple processes App Store payments. The app reads products, transaction proofs and expiry information to determine access; it does not receive payment card details. Desktop activation attempts local networking and a Cloudflare relay in parallel, carrying an end-to-end encrypted grant and any sync settings you approve, not vault files. Even if the local route succeeds, Cloudflare may already have received requests and seen public IP addresses, timing and random session identifiers.

Pairing codes are valid for 120 seconds; relay session entries have short expiry times. This does not mean the provider’s network or security logs are deleted on the same schedule. The relay cannot decrypt the grant envelope.

5. AutoFill, web content and sharing

If you enable password AutoFill, domains, usernames and record identifiers are added to the local system credential index for suggestions, without passwords. Credentials are separately cached in encrypted local storage protected by biometrics, then passed to system AutoFill after verification. Turning this feature off clears the derived cache and index.

HTML uses restricted preview by default. If you explicitly enable the full web engine, scripts and remote content can make network requests and may send that file’s contents or connection details to specified sites. Export, sharing or filling passes relevant plaintext to the system feature or recipient you choose.

6. Diagnostics, support and this website

The app contains no advertising or third-party behavioral analytics SDK. App diagnostic logs stay on-device and are not automatically sent to the developer. You can review, export and send them yourself. Logs are designed not to contain filenames or file contents. If you email us, we receive your address, message and any material you attach to handle your request.

The website uses Cloudflare for delivery and security and may download fonts from Google Fonts. These connections expose IP addresses, requested paths, timing and browser information to the relevant service. The website stores your language preference locally. See the privacy information from Cloudflare, Google and Apple for their service processing.

7. Retention, deletion and choices

You control your local vault and own cloud copies. In-app deletions can propagate through sync, but disconnecting sync, uninstalling or cancelling a subscription does not erase all cloud copies, old backups or provider version history. Manage those copies in their respective locations and revoke authorization with your provider if desired. Clearing AutoFill does not delete source records in the vault.

Support messages and attachments are retained only as needed to handle requests and meet applicable obligations. Email us to request access, correction or deletion of support data we hold, or raise a privacy concern. We cannot decrypt your vault for you. Other applicable data rights remain unaffected. The app does not sell vault contents or use them for advertising profiles.

8. Children, updates and contact

The app is not specifically directed at children under 13. Contact us if you believe our support channel received children’s information that should not be retained. Changes to this policy are dated; updating the webpage does not replace additional notice or consent required by law.

Provider: Yayun Liu. Privacy and support: [email protected]. See also the Terms of Use and Help & Support.