1. Who is responsible and what this covers
TSAC DIGITAL LLC, a New Jersey limited liability company, is responsible for the personal-data practices of TSAC Vault described here. Contact support@tsacvault.com for privacy, access, deletion, appeal or security requests. Mailing address: TSAC DIGITAL LLC, 96 Clinton Ave, Newark, NJ 07114, United States. This policy covers the iOS app, its account/cloud features when available, related support and the TSAC legal/support pages supplied with this policy. It does not govern an independently operated destination to which you export files. Business telephone: +1 (646) 829-5872.
This notice explains the data used for your vault. Version 1.0 provides local use and manual cloud transfers for existing accounts with capacity. Version 1.0.1 adds email enrollment on a new device, an optional local PIN, managed recovery for enrolled libraries and the optional one-time Local Expansion.
2. Account and authentication information
When you use cloud-account features, we process your email, account identifier, verification status, authentication requests and credentials needed for those features. Supabase provides authentication. Password and code submissions go to the authentication service; session tokens authorize access. A remembered cloud session, where enabled, stores an encrypted refresh credential locally using a key derived from the unlocked vault key.
Apple performs device biometric matching. TSAC Vault receives the outcome of local authentication, not your Face ID template or device passcode. These controls do not make email verification multi-factor authentication. The account flow does not require a telephone number, address book or separate app PIN.
3. Files, metadata and sensitive information
You choose photos, videos and documents to import. Files can contain names, images, voices, location embedded by the source device, health details or other sensitive information about you or other people. TSAC Vault does not request live precise location merely because an imported file contains location metadata. You should have authority to store information about others.
Local vault content is encrypted. When you choose an available cloud-backup feature, encrypted content and the metadata needed to store and retrieve it are sent to storage. Operational information can include account/vault/object identifiers, byte counts, dates, quotas, status and cryptographic integrity values. File titles and album organization are handled within the supported encrypted metadata format; this does not mean every server record is encrypted with your vault key.
Where applicable law requires consent for sensitive-data processing, that consent must be obtained separately and specifically before the processing. Reading this policy, accepting general Terms or granting a device permission does not substitute for such consent. Ask support to withdraw a consent; stopping the affected cloud feature may be necessary, while mandatory deletion and other rights remain.
4. Encryption and KIS1 recovery
For libraries using KIS1, the matching recovery code and package protect the vault key. Keep these materials for recovery. An account password reset alone cannot replace them.
Version 1.0.1 supports managed recovery after enrollment. The service associates your account and vault identifiers with an encrypted copy of the vault key, and can return the key after fresh email verification. TSAC controls the service that unwraps that key and has the technical ability to decrypt managed content. This applies to enrolled libraries, including a legacy library after completed migration.
A support request does not give unrestricted permission to inspect vault content. Any authorized operational access must be limited to the specific service, security or legal purpose and to personnel who need it. Do not send vault secrets to support.
5. Technical, purchase and support data
Cloud and email providers process network and delivery information needed to respond to requests, such as IP addresses, request times, response/error status and account or message identifiers. Security and operational records can be personal information even if the file bytes are encrypted. We do not promise that infrastructure logs contain no identifiers.
Apple processes the one-time purchase and any restoration or refund. The app checks Apple-signed transaction information on your iPhone to determine the local file limit. This local purchase does not send transaction records to TSAC’s cloud service. Apple handles payment details.
Support processes your contact information and what you choose to send. Do not email passwords, verification codes or recovery secrets. Send private file contents only if a necessary, agreed support procedure calls for them. Version 1.0 does not include a third-party advertising, session-replay or behavioral analytics SDK.
The TSAC support and legal pages contain no advertising pixels, analytics scripts, upload forms or browser-storage code added by TSAC. OpenAI Sites hosts these pages on Cloudflare infrastructure and automatically records visitor and page-view statistics. Hosting can process technical request information such as IP address, request time, page path, browser information and errors. These website records are separate from vault content. Email links open your mail provider; opening a link does not itself send a message.
6. Purposes and prohibited secondary uses
We use the relevant data to authenticate accounts; deliver requested storage, backup, recovery and export; administer capacity and authorized purchases; answer support/privacy requests; prevent unauthorized access and abuse; diagnose service failures; comply with law; and establish or defend lawful claims. We limit each use to data reasonably needed for that purpose.
TSAC does not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising or train AI models on vault content. We do not create advertising profiles from files or infer sensitive traits for marketing. This notice does not authorize those practices in advance. Essential service and security email is distinct from optional marketing; accepting Terms is not marketing consent.
7. Recipients and service providers
Supabase: authentication, databases, private file storage and server functions; relevant account identifiers, credentials processed by Auth, encrypted stored content, operational metadata and network/security records. The reviewed project is in Oregon, United States (us-west-2).
Resend: delivery of verification and account-recovery emails; recipient email, message contents including the code being delivered, and delivery records. Mailbox/support providers process the communications you send or receive. These emails should not include vault keys or stored files.
OpenAI Sites and Cloudflare infrastructure host the public support and legal pages and process technical traffic records and statistics. This site has no vault-upload function and does not receive your vault files. Provider information is available at https://openai.com/policies/privacy-policy/ and https://www.cloudflare.com/privacypolicy/. Contact TSAC for questions about records associated with a visit to tsacvault.com.
Apple: app distribution, device authentication and, if enabled, in-app billing and purchase status. Apple also handles information under its own privacy notices. An export destination receives the readable material you expressly send to it.
Service processing on TSAC's behalf must be subject to appropriate instructions, safeguards and contractual restrictions. TSAC remains responsible for duties that apply to its use of providers. We may disclose information where a valid legal duty requires it or where a proportionate, lawful security response or legal claim requires it. Professional advisers and lawful business successors may receive necessary data with applicable confidentiality and purpose limits; no sale-of-assets clause authorizes a new unrelated use.
8. Device choices and permissions
The system photo picker supplies the items you select, without requiring the app to read the entire library. Camera access is requested when you choose document scanning. Permission to add to Photos is requested when exporting there. The Files picker supplies documents you choose. You can refuse camera/Photos permissions and use available alternatives; some chosen functions will then be unavailable.
The reviewed app does not request microphone, contacts, live location or advertising-tracking permission. Biometric matching stays with the device. iOS Settings controls the relevant permissions. Exported copies in Photos, Files, iCloud or another service follow that destination's settings and retention. Device authentication and cloud-account authentication have separate purposes.
9. Retention and deletion criteria
Account identifiers and active cloud files are retained while needed to provide the account and selected storage, subject to your deletion request and applicable law. Local files remain under the app's local-library controls; cloud-account deletion does not erase local or exported copies. A local Trash action does not itself remove an existing cloud backup.
After a verified deletion request, removal of the active account and cloud data may have pending stages. Limited security records, a minimal account-deletion marker, support communications or records subject to a valid legal hold may remain for the justified purpose and necessary period. The account-deletion marker records the account ID and request date to prevent old credentials from reopening a deleted account; it is not a copy of file content. A failed or pending deletion is not confirmation that removal has finished.
We retain support emails in the mailbox managed by TSAC for 90 days after the case is resolved and then delete them from that mailbox. Specific records may be retained longer where required for an actual legal obligation, dispute or valid legal hold, limited to that purpose and reviewed when the reason ends. This support-mailbox period does not set the retention period for vault files or provider backups.
Provider logs and backups have retention and deletion cycles separate from active vault files and the TSAC support mailbox. Relevant criteria include the period needed to operate the service, the applicable backup cycle, security and abuse prevention, legal obligations and an actual dispute or legal hold. TSAC does not promise immediate erasure from every backup or a fixed deletion period that the provider has not confirmed. Contact support for retention information or to request deletion of records linked to you.
For the Resend Free email service in use, published retention information states 30 days for emails and logs, a seven-day backup cycle and up to 90 days to remove remaining data after service termination. Supabase log-viewing windows do not establish when all underlying records are erased, so this policy does not present them as deletion deadlines. OpenAI has not supplied TSAC with a fixed Sites-specific retention period for visitor records; its general privacy notice describes retention according to service needs, security, disputes and legal obligations. The support mailbox provider may also retain backup or security records under separate cycles. These provider records are not covered by the 90-day TSAC support-mailbox rule.
When a legal obligation or actual dispute requires longer retention, the purpose limits continue to apply. A deletion request does not authorize reuse of retained data for an unrelated purpose. TSAC can explain the status of its deletion process and seek assistance from the relevant provider; it cannot erase independent copies you exported to another service.
10. Requests, identity verification and appeals
You can email support@tsacvault.com to request access, correction, deletion, a portable copy or an explanation of a decision. An account email and a description of what you seek help us respond; suggested subjects are "Privacy request" or "Privacy appeal", but no special wording or form is required. The in-app account-deletion route is also available in Cloud > Manage account. If you cannot sign in, contact support rather than creating a new account.
We may request proportionate evidence of identity and an agent's authority when legally permitted. Do not send passwords, one-time codes, KIS1 codes or a government ID unless a justified secure verification process has first been arranged. Opt-out requests will not be subjected to verification that applicable law forbids. We will explain a refusal, available appeal and the relevant response period. Applicable law determines deadlines, extensions, fees and exceptions. We will not penalize you for exercising protected rights.
A request may be submitted without accepting these Terms or buying a plan. For an appeal, identify the earlier request and why you disagree; use the same contact channel. TSAC may restrict disclosure of another person's information, trade secrets or information covered by a lawful exception, but will explain the applicable reason and any available partial response. A denial must not be based solely on embarrassment, criticism or the fact that a request requires work.
11. New Jersey and other U.S. rights
Where the New Jersey Data Privacy Act applies, qualifying consumers may request confirmation/access, correction, deletion and portability and may opt out of covered sale, targeted advertising or significant-effect profiling. A verified request generally receives a response within 45 days; a permitted extension of up to 45 more days requires timely explanation. An appeal receives a written response within 45 days. You may complain to the New Jersey Division of Consumer Affairs at https://www.njconsumeraffairs.gov/Pages/Consumer-Complaints.aspx.
Other state laws, including California law where applicable, may provide rights to know categories/specific information, delete, correct, obtain a copy, opt out of sale or sharing, limit certain sensitive-information uses and use an authorized agent. Categories, sources, purposes and recipients are described in sections 2-7; retention criteria are in section 9. These laws have differing coverage thresholds and exceptions. We do not represent that every state's comprehensive law applies identically to TSAC.
The reviewed model has no sale, advertising sharing or targeted advertising to opt out of. If that changes, the relevant notices and legally required opt-out signals, including Global Privacy Control where applicable, must be implemented before that activity. The native app does not track users across third-party websites or use browser tracking cookies. Browser "Do Not Track" signals do not change this native app processing; they are not treated as permission to track. This does not diminish obligations to honor legally required opt-out signals when applicable.
For New Jersey consumers, we do not sell sensitive data, including through licensing arrangements that constitute such a sale. We do not rely on a small customer count or purported consent to authorize a prohibited sale. Where New Jersey consent requirements apply, withdrawing that consent must be as easy as giving it, and the affected consent-based processing must stop as soon as practicable and no later than the applicable 15-day limit, subject to processing independently permitted by law.
12. International processing and additional rights
TSAC is based in the United States. Cloud storage for the configured project is in the United States, and providers may process operational and support information in other countries. Privacy laws in another country can differ from those where you live. Contact support for information about the processing location and safeguards relevant to your request. This notice does not claim that TSAC holds an international data-transfer certification.
Where EEA or UK data-protection law applies, the relevant processing requires a lawful basis: performance of a contract for necessary account and storage services, a legal obligation for required records, legitimate interests for proportionate service security and claims where those interests are not overridden by your rights, and consent for optional processing when required. Sensitive categories require an additional lawful condition; a contract alone is not enough. Withdrawing consent does not make earlier lawful processing unlawful.
Applicable rights can include access, rectification, erasure, restriction, portability, objection to legitimate-interest processing and complaint to your supervisory authority. Requests under EEA or UK data-protection law are normally answered within one month, with only legally permitted extensions. We do not use vault content for automated profiling decisions with legal or similarly significant effects. Local mandatory protections remain applicable beyond the regions specifically discussed here.
Where consent is the basis, the choice must be specific and withdrawal accessible. Contact support to withdraw; any in-app consent control offered must also support withdrawal. We must explain if stopping a necessary processing operation prevents that cloud feature from continuing, while preserving applicable export, deletion and consumer rights. An uploader cannot automatically consent on behalf of every person depicted or mentioned. Private material may reveal health, sexual life or other protected information even without face recognition; TSAC must establish the relevant lawful conditions before processing it.
App Store availability and access to particular cloud functions can differ by region. Publication of this policy does not itself open cloud-account registration or announce a worldwide launch. TSAC remains responsible for applicable transfer safeguards and local representation requirements; contact support for the details relevant to your region.
13. Age and information about children
The Service is intended for adults aged 18 or older, subject to local legal capacity. It is not directed to children and does not offer child accounts. A statement of age eligibility does not excuse obligations if TSAC learns it has collected a child's data unlawfully. Contact support if an ineligible person has an account so the situation can be investigated and handled under applicable law.
Adults may choose to store lawful family photos. That is not permission for TSAC to identify children biometrically, advertise to them or reuse the images for unrelated purposes. Age verification and any future younger-user product need separate review and appropriate safeguards before introduction.
14. Security, incidents and policy changes
The implementation uses authenticated vault encryption, protected local keys, authenticated server requests and account-based access controls. Correct production configuration, restricted operational access, key custody, retention and incident response remain essential; a policy or a successful build does not prove those controls are deployed. No system is absolutely secure. Report a suspected incident to support without sending secrets. TSAC must provide breach notices to people and authorities when applicable law requires them.
This policy is effective October 31, 2026. We will communicate material changes appropriately through the app, this website or account email, with consent requested where required before a new use begins. Posting a changed notice does not retroactively authorize incompatible use. You can request this notice in an accessible format or ask about any data practice through support@tsacvault.com.