CAL

Privacy Policy

Last updated 15 October 2026 · applies to CAL for iOS, published by WitWork

The short version. CAL has no accounts and we run no server that receives your files. Everything you put in your vault is stored on your iPhone, and the contents are encrypted. We never see your photos, files, notes, passwords or contacts. What does leave your device is listed below: anonymous usage statistics and crash reports (Google Firebase), your optional encrypted iCloud copy, your Recovery Code in your iCloud Keychain (Apple), purchases (Apple), and the websites you choose to visit in the private browser.

This policy explains how WitWork ("we", "us") handles information for the iOS app CAL, listed on the App Store as "CAL: Secret Photo Vault" (the "App"). WitWork is the controller of the limited data described here.

1. What stays on your device

Your vault — photos, videos, files, notes, passwords and contacts — is stored inside the App on your iPhone. It is not uploaded to us, and we have no technical means to read it.

Encrypted: photo, video and document contents and their thumbnails, contact photos, password secrets, and note titles and text are encrypted with AES-256-GCM using a random 256-bit key kept in the iOS Keychain. The key is not derived from your passcode.
Your passcode and any decoy passcodes are stored only as salted, slow (PBKDF2) hashes in the iOS Keychain. We never see them.
Stored without the additional encryption: some information that describes your vault is kept in the App's local database protected by iOS but not by the App's own encryption — for example file and folder names and sizes, contact names and details, password entry titles, usernames and websites, bookmarks and browsing history. This database is part of the App's data on your device and may be included in an iPhone backup you make to iCloud or to a computer. Protect those backups (for example with an encrypted computer backup).
Decoy vaults are stored on the device only. They are never included in the App's iCloud Sync.
Your browsing in the private browser: history (up to 1,000 pages) and bookmarks are stored on the device. Website cookies and sign-ins are kept in memory only and are discarded when you quit the App.

2. What leaves your device

2.1 Usage analytics — Google Firebase Analytics

We record how the App is used so we can understand which features work and fix problems. The App sends events such as "app opened", "vault unlocked", "unlock failed", "paywall shown", "purchase completed", "file imported", "backup completed" and which screen was viewed, together with technical parameters (for example counts, durations, file type such as "photo", the plan name, the language you chose, and whether an action succeeded).

Each event may also carry these categories and yes/no flags:

Information	What it holds
Subscription tier	free or Pro
Active vault	whether the event happened in the main vault or a decoy vault
Decoy vault enabled	yes or no
Recovery Code set	yes or no — never the code
Biometrics	enabled or not, Face ID or Touch ID
Face-down behaviour	which setting is chosen

Analytics never include the contents of your vault, passcodes, your Recovery Code, the addresses of websites you visit or what you search for. In rare cases an error message reported by iOS when an import fails may include a file name. Firebase also collects standard device information (such as device model, iOS version, app version, country derived from IP address) and assigns a random app-instance identifier. It is not your name, email or Apple ID.

The Google Analytics SDK includes Google's advertising-measurement components. The App never asks for permission to track you, so it does not access your device's advertising identifier (IDFA), and it does not give Google your email address or phone number. We do not sell your data or use it for advertising profiles.

2.2 Crash reports — Google Firebase Crashlytics

When the App crashes we receive a technical report: device model, iOS version, app version, the time of the crash and a stack trace showing where in our code it failed, linked to a random installation identifier. Crash reports do not contain vault content.

2.3 Your Recovery Code — iCloud Keychain (Apple)

The 16-character Recovery Code that can reset a forgotten passcode is stored in your iCloud Keychain, so it is available on your other Apple devices signed in to the same Apple ID. iCloud Keychain is end-to-end encrypted by Apple. The code is checked on your device and is never sent to us. If iCloud Keychain is off, the code stays on this device only. You can also choose to export it as a file through the iOS share sheet; where that file goes is up to you.

2.4 iCloud Sync — iCloud Drive (Apple)

iCloud Sync is off unless you turn it on. When it is on:

Your main vault (files, folders, notes, passwords, contacts and bookmarks) is encrypted on your device before upload and stored in your own iCloud Drive, in a folder named "CAL" that you can see in the Files app. We cannot read it, and neither can Apple.
The key that unlocks it is copied to your iCloud Keychain (end-to-end encrypted by Apple) so your other devices can open the vault. It is removed from iCloud Keychain when you turn sync off.
Inside the encrypted data the App records which device made each change (a random device identifier and the device's name or model), so it can tell which device is the "main device".
Decoy vaults, browsing history and device-specific data are never uploaded.
You can stop syncing or delete the iCloud copy for every device from the App's settings.

2.5 Purchases — Apple App Store

Subscriptions and the lifetime purchase are processed entirely by Apple. We never receive your card details, billing address or Apple ID. The App only checks with Apple whether a purchase is active.

2.6 The private browser

When you use the in-app browser, the websites you visit receive what any browser sends them, such as your IP address and a standard Safari user agent; their own privacy policies apply. Searches typed in the address bar go to Google. To show website icons, the App requests them from the website you are viewing. Images, files and page captures you save go into your vault on the device. We do not receive or log any of this.

2.7 When you contact us

If you email us from the App, the message is pre-filled with your app version, device model and iOS version to help us diagnose problems. You can edit it before sending. We use your email only to reply to you.

3. Permissions the App asks for

Permission	Why
Camera and microphone	To take photos and record videos directly into your vault. Asked only when you open the in-app camera.
Photos (add only)	To save an item from your vault back to your photo library when you ask. Importing uses Apple's photo picker, which shares only the items you select.
Face ID / Touch ID	To unlock your vault (Pro). Apple handles your biometric data; the App never receives it.
Motion sensors	Face-down and shake actions read the device's motion on the device only. No permission is needed and nothing is stored or sent.

Contacts are imported through Apple's contact picker, which shares only the contacts you choose. The App does not request your location, does not access your whole contact list or photo library, and does not ask to track you across other companies' apps and websites.

4. Why we process this information

To provide the App and the features you use, including purchases and iCloud Sync (performance of our agreement with you).
To keep the App working and improve it through analytics and crash reports (our legitimate interest in a reliable, secure app).
To access your camera, microphone, photos or biometrics only when you grant iOS permission (your consent, which you can withdraw in iOS Settings at any time).

5. Who receives information

Google (Firebase Analytics and Crashlytics), as our service provider. Google describes Firebase's privacy practices at firebase.google.com/support/privacy.
Apple, for iCloud Keychain, iCloud Drive, purchases and App Store services, under Apple's Privacy Policy (apple.com/legal/privacy).
Authorities, only if required by law. Because we do not hold your vault, your passcode, your Recovery Code or your encryption key, we cannot hand them over.

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

6. International transfers

Google and Apple may process data in the United States and other countries. Where required, these transfers rely on the safeguards those companies provide, such as Standard Contractual Clauses.

7. How long data is kept

Vault data, history and settings on your device: until you delete them or delete the App.
iCloud copy and iCloud Keychain items: until you delete them (from the App, from iCloud or from iCloud Keychain). They are not removed just by deleting the App.
Analytics: kept for a limited period under our Google Analytics retention settings, then deleted by Google.
Crash reports: kept by Google for up to 90 days.
Support emails: as long as needed to handle your request.

8. Your rights and choices

You can view, edit, export or delete everything in your vault directly in the App.
You can turn off camera, microphone, photo and Face ID access at any time in iOS Settings.
You can stop iCloud Sync, delete the iCloud copy in the App, and remove the "CAL" folder in the Files app. See deleting your data.
Depending on where you live (for example under the GDPR, UK GDPR or California law), you may have rights to access, correct, delete, restrict or object to processing of your personal data, and to complain to a data protection authority. Because analytics and crash data are tied only to random identifiers, we usually cannot link them to you; email us and we will help as far as we can.

9. Security

We design the App so that we never need your data: encryption on the device, keys in the iOS Keychain, no accounts and no server of our own. No system is completely secure, though. Keep your passcode and Recovery Code private, protect your Apple ID, and see section 1 for the information that is stored without the App's additional encryption.

10. Children

The App is not directed at children under 13 (or the higher minimum age where you live), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

If we change this policy, we will update the date at the top and describe material changes on this page or in the App.

Contact

WitWork — questions about this policy: witwork.digital@gmail.com.