Privacy Policy

Nevervault is a local-first Mac app with optional clients for your other Macs, iPhone, and iPad. Your photo and video originals stay where you keep them and under your control. If you enable Remote Access, your Mac serves content to devices you approve using end-to-end encryption. We never sell your data.

Your photos and videos

Nevervault reads the files you point it at on a strictly read-only basis to build a search index. It never modifies, moves, copies to the cloud, or deletes your originals. The previews and search index it generates are stored locally in the app's private container. Optional Remote Access sends previews, requested media, and search results to your paired clients. Clients may cache previews and media locally, and you may save a copy to your device. Your Mac keeps the search index; it is not uploaded to our servers.

What uses the network

Nevervault connects to the network for these narrow purposes:

• Purchases. Subscriptions are handled by Apple's App Store (StoreKit) or, for the version downloaded from this site, Stripe. Foundnone never receives your full card number. The direct version stores an opaque license identifier and device-slot records so a license can be limited to the number of Macs stated at purchase.
• Optional Remote Access. Paired devices connect directly on your local network or through our internet relay. Library content and queries are end-to-end encrypted between your Mac and its clients. Our relay cannot decrypt them and does not persist photos or videos. To authenticate connections, enforce revocation, and apply usage limits, our services retain host public keys and relay identifiers, hashed paired-device identifiers, signed lease and pairing registration metadata, license or free-identity identifiers, and quota counters. These records are used for app functionality and abuse prevention, not advertising. Free relay eligibility also uses Apple's DeviceCheck and a server-side identity ledger; its DeviceCheck bit is separate from the free-trial bit. DeviceCheck tokens are not stored.
• Free-trial activation. The app sends an ephemeral Apple DeviceCheck token and a random app-generated UUID to nevervault.com. Our server asks Apple whether that Mac has already used the offer, stores the random UUID plus the trial's start, expiry, and last-check times, and returns a signed offline trial grant. The Apple token is never stored. Apple retains one yes/no DeviceCheck bit for this offer. Trial requests also use a one-hour abuse counter whose key is a one-way hash of the request IP address; the raw address is not placed in that counter.
• Licensing and updates. The direct version may check its signed license, device slot, revocation list, and signed update feed with nevervault.com. A previously activated license and trial continue to work offline through their applicable terms.
• Your own iCloud Photos. If you connect your iCloud Photo Library and enable "Fetch from iCloud when needed" (on by default, off in Settings), Nevervault downloads from your own iCloud account through Apple's Photos system: small versions while indexing, and a photo's original only when you open or edit that photo. These are downloads of your own content, handled entirely by Apple's frameworks. Nevervault does not upload your library to iCloud. Optional Remote Access can serve content fetched from iCloud to your paired devices.

There is no behavioral analytics, advertising, or sale of data. Drive and folder archives index and search locally. Purchase, trial, licensing, and update requests do not contain your library content or search terms. Remote Access sends library requests and content only through its encrypted connection to your approved devices.

Accounts and personal data

Nevervault has no in-app profile system. You don't provide an email address to activate the free trial. If you buy the direct version, Stripe and Foundnone use the email address you provide for receipts, license recovery, and subscription management.

Data retention and deletion

Your search index and generated transcripts remain on your Mac. Remote clients keep local preview and media caches; a temporary disconnect does not clear them. When the client receives a revocation, it clears that host's cached previews, viewer renders, search results, and video-playback cache. User-initiated downloads, including partial files in a selected download destination, and copies saved to Photos or Files remain under your control. The trial record is retained to enforce the one-trial-per-device rule; license device records remain until the slot is removed. Short-lived abuse counters expire automatically. Relay identity, paired-device, and lease records are retained to authenticate connections and enforce access; expiring credentials stop admission but do not by themselves promise immediate deletion of every stored record. Relay usage counters enforce the applicable quota periods. Free relay identity records enforce the monthly eligibility rule. Contact us about server-record deletion; deleting a record may require pairing again or affect trial eligibility. Purchase records are retained by Apple or Stripe under their policies and as required for billing and legal compliance.

Children

Nevervault is a professional tool and is not directed to children under 13.

Changes

If this policy changes, we'll update the date above and post the new version here.

Contact

Questions about privacy? Email hello@nevervault.com.