Contents
1. Overview & Our Commitment
Calc+ Vault is a privacy-first application developed by Cloud Strategy, Inc. The app is designed so that your vault contents — photos, videos, notes, documents, and messages — never leave your device unless you explicitly choose to back them up.
The short version: Your vault contents are encrypted on your device and are never readable by us. We only collect the minimum information necessary to authenticate your account and deliver notifications for calls and messages.
This Privacy Policy applies to the Calc+ Vault applications for iOS (distributed through the Apple App Store) and Android (distributed through Google Play), and to the websites at cloudstrategy.ai and vault.cloudstrategy.ai. By using the app, you agree to the practices described here.
2. Information We Collect
Account & Authentication
- Phone number — collected when you register for private messaging or calls. We verify it with a one-time code sent by Twilio Verify, then sign you in with Firebase Authentication. Used solely to verify your identity and route your messages and calls.
- Firebase User ID — a unique identifier assigned by Firebase upon registration. Used to associate your encrypted data in our database with your account.
Push Notifications
- Device push token (APNs/FCM) — stored in our database to deliver incoming message and call notifications to your device. We do not include any message content in push payloads — notifications are delivered as silent pings that the app resolves locally.
Messaging & Calls (Pro & Ultimate)
- Encrypted message metadata — sender and recipient identifiers, timestamps, and encrypted message ciphertext stored in Firebase Firestore. The ciphertext is encrypted with keys that exist only on your device; we cannot read the content.
- Vault-to-vault call signaling — to connect a call between two Calc+ Vault users, the apps exchange connection details (caller and recipient IDs, call status and network addresses) through Firebase Realtime Database. Calls connect directly between the two devices, so each party's IP address is visible to the other and to the Google STUN servers used to set up the connection. Call audio is not recorded or stored.
- PSTN call records (Ultimate) — when you make calls to external phone numbers in the US and Canada via Twilio, call duration and the destination number are processed by Twilio to complete the call. See Third-Party Services below.
Subscriptions & Purchases
- Subscriptions are purchased through the Apple App Store or Google Play. Payment details are handled entirely by Apple or Google; we never see your card or billing information. The app checks your subscription status with the store to unlock paid features.
Device Permissions
- Microphone — used only while you are on a call you placed or answered.
- Contacts — read only when you choose to import contacts into your vault. Imported contacts are stored encrypted on your device and are not uploaded to our servers.
- Notifications — used to alert you to incoming calls and messages.
- Photos and files — accessed only through the system picker for items you select to import.
Crash & Diagnostic Data
- If your device settings permit, Apple (through App Store Connect) or Google (through Google Play Console) may collect anonymised crash and performance reports and share them with us. These reports do not include any vault content.
3. Information We Never Collect
We have no access to the following, by design:
- Photos, videos, documents, or notes stored in your vault
- Your vault PIN, or Face ID, Touch ID and fingerprint data
- Your private encryption keys (generated on-device, never transmitted)
- Decrypted message content — messages are end-to-end encrypted with Curve25519 keys
- Your device contacts or address book
- Browsing history from the private browser
- Your location
- Advertising identifiers (Apple IDFA or Google Advertising ID)
We do not sell, rent, or share your personal information with third parties for marketing purposes.
4. How We Use Your Information
- Phone number — to authenticate your account and enable private messaging between verified users
- Firebase User ID — to store and retrieve your encrypted message data and route incoming communications to your account
- Push token — to notify your device of incoming messages and calls without revealing any content in the notification
- Crash reports — to identify and fix bugs that affect app stability
We do not use any collected information for advertising, profiling, or sale to third parties.
5. Data Storage & Security
On-Device Storage
All vault content (photos, videos, notes, documents) is stored locally on your device and encrypted with AES-256-GCM. On iOS the key is derived from your PIN via HKDF-SHA256; on Android the keys are held in the hardware-backed Android Keystore. Your PIN and encryption keys are never transmitted to our servers. On Android, vault data is also excluded from Google device backups and device-to-device transfers.
Encrypted Cloud Backup (Pro & Ultimate)
When you enable Sync, an encrypted backup of your vault is stored in the cloud: on iOS in your personal iCloud account, and on Android in Firebase Storage under your account. In both cases the backup is encrypted with your PIN-derived key before it leaves your device, so we cannot access its contents — we hold only unreadable ciphertext.
Firebase (Server-Side)
Firebase Firestore and Firebase Storage are used to store encrypted message ciphertext and call routing data. Firebase infrastructure is operated by Google LLC under Google's Cloud Security standards. All data in transit uses TLS encryption.
Data Retention
Your account data in Firebase is retained as long as your account is active. You can delete your account and all associated cloud data from within the Android app (Settings, "Delete account and data"), or request deletion at any time at vault.cloudstrategy.ai/delete, or by emailing support@cloudstrategy.ai; we process deletion requests within 30 days. Vault content stored only on your device is deleted when you uninstall the app.
6. Third-Party Services
Firebase (Google LLC)
We use Firebase Authentication, Firestore, Realtime Database, Storage, and Cloud Messaging. Firebase may process your phone number and device identifier in accordance with Google's Privacy Policy at policies.google.com/privacy.
Twilio
Twilio Verify sends the one-time code used to verify your phone number when you register. On the Ultimate tier, outbound calls to external phone numbers and SMS messages sent to external numbers (US and Canada only, through a shared toll-free line) are also routed through Twilio. Twilio processes the destination phone number and call/message content as a telecommunications provider. Twilio's Privacy Policy is available at twilio.com/legal/privacy.
Apple (iCloud, TestFlight, App Store)
If you use iCloud Sync, your encrypted backup is stored in your Apple iCloud account. Apple's privacy practices are governed by Apple's Privacy Policy at apple.com/privacy.
Google Play (Google LLC)
The Android app is distributed through Google Play, and subscriptions on Android are processed by Google Play Billing. Google handles your payment information and shares only your subscription status with the app. Google's privacy practices are governed by Google's Privacy Policy at policies.google.com/privacy. You can manage or cancel a Google Play subscription at any time in the Google Play Store under Payments & subscriptions.
We do not integrate any advertising SDKs, analytics platforms, or data brokers.
7. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you
- Correction — request correction of inaccurate data
- Deletion — request deletion of your account and associated data from our servers
- Portability — request your data in a portable format
- Objection — object to processing of your data in certain circumstances
To exercise any of these rights, contact us at support@cloudstrategy.ai. We will respond within 30 days.
Note: We cannot access or delete vault contents stored on your device — that data is encrypted with your PIN and exists only locally. To delete it, use Settings → Danger Zone → Clear Vault on iOS or Settings → Delete account and data on Android, or uninstall the app.
8. Children's Privacy
Calc+ Vault is not directed at children under 17 years of age. We do not knowingly collect personal information from children under 17. If you believe a child has provided us with personal information, please contact us at support@cloudstrategy.ai and we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Significant changes will be communicated via an in-app notice. Your continued use of Calc+ Vault after changes take effect constitutes acceptance of the updated policy.
10. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out:
- Email: support@cloudstrategy.ai
- Company: Cloud Strategy, Inc.
- Website: cloudstrategy.ai