Updated 7 November 2026
The native app stores encrypted vault content on your device. It has no Sitara account, advertising SDK, or analytics SDK. Files and their encrypted index stay behind your vault credential. Your recovery code is your responsibility; keep it separately.
Opt-in backup, sync, and encrypted invitations use Apple CloudKit and your Apple Account. Apple's storage and service terms apply. Camera, microphone, Photos, and file permissions are requested for the actions you choose. Removing an original from Photos is a separate explicit action after import verification; Photos may retain it in Recently Deleted.
The optional online access service uses Vercel and Supabase. It stores opaque share identifiers, capability hashes, an encrypted access envelope, expiry and open policies, and usage counters. The app does not send readable vault files or access phrases to this service. Scheduled cleanup clears expired envelopes and removes ended share records after 30 days; rate-limit buckets are removed after two days. Online checks apply to future opens and cannot recall saved copies.
In the 1.5 candidate, receiving is configured for one vault after owner authentication. The extension gets a public receiving key and writes encrypted copies into a shared local container; it cannot read existing vaults or their private keys and makes no app-operated network request. File providers may use their own services. Queue counts, encrypted sizes and work timing can be visible in local files. Unlock the matching vault to approve import and verify bytes. Pending copies are not backed up or synced, do not silently expire, and can be discarded; reset, disable or live duress removes them or retries failed cleanup. Sources stay unchanged.
Check suggestions are processed on-device and can miss details. Pro batch Check reviews 2–20 still photos one at a time; only actual encoded copies you approve can be shared. Approved copies are staged encrypted with a memory-only key, outside backup and sync. Editing invalidates approval; session loss clears the work and attempts cleanup. Deliberate system sharing prepares protected plaintext files, and the OS or destination can retain copies. Losing Pro stops new batch work but keeps approved copies shareable in the valid session; single-photo Check stays free. Images and recognized text are not uploaded as analytics.
Vercel hosts this website and may process standard hosting request logs. The website does not add an advertising or analytics tracker. The support form prepares a message in your mail app; it does not submit a support ticket. Email you choose to send is handled to answer your request. Never include private files, credentials, recovery codes, or share codes.
You can delete local content in the app and manage optional cloud copies separately. Shared or exported copies may remain with recipients; revoking access does not recall them. Contact support@ummahsignal.com with privacy questions. This beta policy was updated on 7 November 2026.
