Skip to content

Vault Privacy Policy

This policy covers the Vault app for iPhone and iPad, and Vault's pages on this website.

Last updated: 28 September 2026.

The short version: Vault has no servers and sends nothing to us. Everything you put in it stays on your device, apart from the backups you choose to make.

Who is responsible for your data

The data controller is Bad Bundle Limited, a company registered in England and Wales, company number 16035056, whose registered office is Silverstream House, 4th Floor, 45 Fitzroy Street, Fitzrovia, London W1T 6EB, United Kingdom.

For anything to do with this policy, email help@badbundle.com.

What Vault collects

Nothing.

Vault collects no personally identifiable information about you. That includes the items stored in your Vault, your passwords, your 2FA secrets, and your notes. All of it is stored on your device and nowhere else.

Vault contains no analytics, no crash reporting, no telemetry, and no advertising identifiers. It makes no network requests of its own. There is no Bad Bundle server for it to talk to, so there is nothing for us to receive, store, or hand over.

Vault displays no advertisements, so there is no advertising token used to identify you.

Apple's own statistics

If you have turned on Share With App Developers in Settings › Privacy & Security › Analytics & Improvements, Apple may give us aggregate statistics about how the app is used, along with crash reports.

This is Apple's collection, not ours. We receive it already aggregated and anonymised, we cannot identify you from it, and Vault's own code plays no part in producing it. Turning that iOS setting off stops it. Apple also provides aggregate App Store sales and download figures, which contain no information about individual people.

Technical basics

Vault stores your information locally on your device, using iOS file encryption. The stronger your device passcode, the better that storage is protected. Items you encrypt with a custom password are additionally protected by that password using standard cryptography.

Vault never syncs this data or sends it to us. It leaves your device only in a backup: an encrypted backup you create, or one Vault makes automatically if you turn that on (both below), or your device's own iCloud or computer backup, which includes app data like Vault's and is covered by Apple's terms.

Backups you create

If you create an encrypted backup, you choose where it goes. You can print it, save it locally, or put it on a third-party storage service such as iCloud.

Vault can also back up automatically. This is off until you turn it on and choose a folder, such as one in iCloud Drive. From then on, Vault saves an encrypted backup to that folder whenever your items change. If the folder belongs to a storage service, like iCloud Drive, that service stores and syncs the backup under its own terms. You can turn automatic backups off at any time.

Once a backup leaves your device it is subject to whatever service you put it on, and that service's own privacy policy applies. If someone guesses or breaks your backup password they can read its contents, so choose a strong one.

Third-party content

Vault may display links or content that originate from third parties. Opening or displaying third-party content involves a request to whoever hosts it, and that party may log the request. This has nothing to do with Bad Bundle, and we do not receive anything from it.

We may disclose information we hold in response to subpoenas, court orders, or other legal requirements, to exercise our legal rights or defend against claims, or to investigate illegal activity or abuse.

We hold no information about you that could be disclosed. There is no account, no profile, and no copy of your data on any system we control, so a demand for it would produce nothing. This is a property of how Vault is built, not a promise about how we would respond.

If this ever changes, the change will appear in this policy before it takes effect.

Business transfers

If we sell, merge with, or partner with another business, any user information we hold could be among the transferred assets. At present there is none.

Your rights

Under UK GDPR you have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to its use, and to receive it in a portable format.

Because we hold no personal data about Vault users, there is in practice nothing for us to produce, change, or delete — the data lives on your device, where you can view, edit, and delete it inside the app at any time. If you believe we hold something about you, email help@badbundle.com. Data protection requests are answered within one month, as the law requires. That is a statutory duty and is separate from general support, which carries no such commitment.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

International transfers

We transfer nothing, because we receive nothing. Apple's aggregate statistics are processed under Apple's own terms and safeguards.

If you choose to store a backup on a third-party service, that service may hold it outside the United Kingdom. Review that service's policy before you use it for a Vault backup.

Children

Vault is not intended for children. We do not knowingly collect information from anyone under 13, and no part of the app or site is structured to attract anyone under 13.

California residents

We comply with the California Online Privacy Protection Act. We do not distribute personal information to outside parties, because we do not collect any.

Changes to this policy

Changes to this policy are reflected on this page, with the date at the top. No notice is given by any other means.

  • 14 September 2026: Corrected the policy to match the app. Earlier versions described analytics collection, a log-sending feature, and Bad Bundle web servers, none of which exist in Vault. Added controller details, your rights, and the ICO complaint route.
  • 24 November 2024: First published.

Other notes

This policy was originally adapted from the Overcast Privacy Policy. If you're looking for a podcast player, I strongly recommend Overcast.