MOMENTVAULT / PRIVACY
Privacy policy
Effective October 20, 2026
This policy covers the MomentVault iPhone and iPad app and its product and support pages.
1. Content stored on your device
The photos, Live Photos and videos you import, and their thumbnails, filenames, capture details, locations, Favorites, albums, recognized text and categories, are stored in an encrypted local library. App passcodes and Face ID control local decryption access; the iCloud recovery password is used only for cloud decryption. We do not provide a server endpoint that reads your library. Import does not automatically delete originals from Photos.
2. On-device analysis and people data
Smart organization is optional. When enabled, on-device models analyze photos and sampled video frames for subjects, text and people. Media is not uploaded to cloud AI. Face feature vectors, groups, names and corrections are stored only in the encrypted local database, excluded from iCloud sync and exported library backups, and not used for authentication, advertising or tracking. Permanently deleting media removes its associated face features. Disabling analysis stops future work and retains completed results.
3. Optional Apple location services
Show Place Names is off by default. With your consent, the app sends existing photo coordinates to Apple’s geocoding service to resolve place names, without sending photos or videos. Results are stored in the encrypted library. Viewing a location map uses Apple Maps and loads the relevant area. The app does not continuously track device location or request background location access. Apple’s handling of service requests is governed by its privacy policy.
4. Optional encrypted iCloud sync
Encrypted iCloud sync requires Pro. First-time setup generates an iCloud recovery password for you to confirm and copy; connecting to an existing cloud library requires the same password. Sync uses your Apple Account’s private CloudKit database for app-encrypted media, thumbnails and library records, plus identifiers, wrapped keys and operational metadata needed for sync. Record identifiers, sizes and access timing are not promised to be hidden. People data, local browsing positions and Face ID credentials are excluded. Decryption credentials are not synced through iCloud Keychain; an Apple Account alone cannot decrypt the library. Turning sync off requires confirmation to erase cloud content and its recovery password, while keeping local content. Other devices stop syncing when they detect that cloud data was cleared and retain their local content. Losing Pro access pauses sync without automatically erasing cloud data.
5. Backups, exports and temporary files
Pro exports originals or a single encrypted backup protected by a separate password. Exported originals are managed by the destination you choose. Backups exclude face features, people groups and names. Media display and export may use temporary plaintext protected by the operating system; controlled caches and temporary files are cleared on lock, and leftovers are checked on next launch after an abnormal exit. We do not promise immediate erasure on forced termination or physical unrecoverability. Confirming an iCloud recovery password or completing an encrypted-library export copies the corresponding password as described on screen. The clipboard copy is local-only; copies already read by other software are outside our control.
6. Purchases, support and website visits
Apple processes Pro purchases. The app verifies entitlements with StoreKit; we do not receive payment-card details. If you email support, we receive the contact information and issue details you choose to provide to respond and troubleshoot. Do not send passcodes, iCloud recovery passwords or private photos. The website embeds no advertising or behavioral analytics scripts. Hosting infrastructure may process IP addresses, request times, page paths and browser details to deliver pages, troubleshoot and protect the service, not for cross-site advertising tracking.
7. Your choices and deletion
You can disable smart organization, place-name lookups or iCloud sync and manage albums, people names and media. Recently Deleted retains items for up to 30 days; expiry cleanup runs after unlock. Permanent deletion propagates to connected devices after successful sync. Exported copies, originals in Photos and independently saved backups must be managed separately. Deleting the app may remove local-only content but does not automatically delete backups or iCloud data. Cloud data can be managed through Apple’s iCloud storage settings. Support correspondence is retained as needed to handle requests and meet necessary security or legal obligations; contact us to request access, correction or deletion.
8. Updates and contact
Updates are published on this page with a new effective date. For new data uses or features requiring consent, we will provide notice or request consent as applicable. Contact: support@tacitlabs.cn.
Your stories. Your memories.
Read our privacy policy →