Lockleaf Privacy Policy

This policy covers Lockleaf for iPhone and its iOS share extension, developed by Loadchange. The new backup, recovery-key, Recently Deleted and extended sharing workflows described below apply to the 1.1 upgrade when available. Apple and any file or sharing service you choose have their own policies.

This page is a website. Our hosting provider receives ordinary technical web-request data, such as IP addresses, headers and access logs, to deliver and protect the site. That processing is separate from the app. Lockleaf product, support and privacy pages do not load our site’s advertising script.

You choose which media to import using Photos, Files, the private camera or the share extension. Originals and thumbnails are encrypted in app storage. The encrypted catalogue can include filenames, format, size, capture/import dates, duration, resource relationships, albums, tags, favorites and deletion dates.

Search and organization happen locally inside the unlocked vault. Lockleaf does not upload media to a developer cloud, publish it to system search or use it to train a model. Available metadata, including any location data in an original, stays with the original unless you explicitly create a privacy-processed sharing copy.

The app uses Apple’s sandbox and device data protection in addition to media encryption. System device-backup behavior depends on your Apple settings; it is different from the user-created Lockleaf encrypted backup described below.

A random vault key encrypts the media; your PIN or passphrase protects a wrapped copy of that key. Optional Face ID uses an Apple Keychain item protected by the enrolled biometric configuration. Lockleaf does not receive or store your face image or biometric template.

An optional recovery key in 1.1 protects a separate wrapped copy of the same vault key. The recovery key is generated on your device and must be saved by you outside the vault. We do not receive your PIN, passphrase or recovery key, keep a master key, or operate a password-recovery server.

The decoy vault is separate local storage with its own credentials and content. Incorrect-password-attempt information, when the Pro feature is used, stays on the device. Changing a vault password preserves the vault contents; changing or rotating a key does not remove old exported backup copies.

In 1.1, you may create a password-protected backup containing the vault’s media resources, thumbnails, albums, organization metadata and Recently Deleted state. The app validates the archive and shows a restore preview. A restore merges verified content into a created, unlocked vault, preserving existing content and skipping exact duplicates.

You choose where to save the backup through Files: for example, local storage, iCloud Drive, an external drive or another provider. Lockleaf does not automatically synchronize the vault to iCloud or upload backups to Loadchange. The chosen provider handles storage or transfer under its own policy.

The backup’s independent password is required to read it. A successful local archive check is not proof of a completed cloud upload. Backup files remain until you remove them from their chosen locations; changing your vault password, rotating a recovery key or deleting a vault item does not change older archives.

Pending share-extension packages are not included in a vault backup. Import them into the vault first if you want them included.

The iOS share extension receives only files you choose to share with Lockleaf. After the main app has been opened and unlocked once to set it up, the extension encrypts supported files into a shared app-group inbox. The extension has an encryption public key, not the private key needed to read your pending content or unlock your vault.

Pending package filenames and media metadata are inside an encrypted manifest. The main app can decrypt them after the real vault is unlocked; you then choose the destination album and complete the import. Sharing to this inbox does not delete source files or establish that a vault import has succeeded.

Pending packages older than seven days are removed when cleanup next runs. Cancelled transfers and interrupted temporary files are cleaned up through the app and extension’s cleanup routines. No pending content passes through a Loadchange server.

Viewing and exporting can require temporary readable files inside the app’s protected storage. The app clears these files on completion, cancellation or its lock/startup cleanup paths. Operating-system and sharing-app copies can have separate lifetimes. We do not claim that deleted flash-storage bytes can be physically overwritten or that a recipient’s copy can be recalled.

Original export preserves the available original media bytes and metadata. It produces readable files outside the vault when you save or share them. Those copies follow the destination’s access controls and privacy policy, and are not removed if you later delete the vault item.

The optional privacy-copy workflow creates a still JPEG, up to 4096 pixels on its longest edge, without source location and camera metadata. Selected opaque covers and watermarks are flattened into that copy. It does not modify the original, include GIF/Live Photo motion, or make recipients unable to copy the shared image. You preview and choose whether to share.

In 1.1, ordinary deletion moves an item to encrypted Recently Deleted for 30 days. Items can be restored during retention; expired items are eligible for permanent cleanup after the next successful vault unlock. Permanent deletion of selected items requires confirmation. Removing an album removes the organization without deleting its media.

Permanent deletion removes the current vault’s references and encrypted originals as cleanup succeeds. A storage or cleanup failure can leave encrypted orphan files; the integrity check can report missing, damaged or orphaned resources. This check does not send your media or report to the developer.

Removing the app may remove local vault files, settings and pending imports under iOS behavior. Copies in your device backups, exported Lockleaf archives, original Photos library or sharing destinations are separate. Preserve and verify important backups before changing devices or removing the app.

Apple processes App Store payments, subscriptions, lifetime purchases, refunds and Restore Purchases. Lockleaf uses StoreKit locally to check transaction and entitlement information; it does not send purchase identifiers to a developer-operated receipt server.

Photos and camera access are requested for the actions you choose. Face ID availability and device authentication are handled by Apple. Media may need to download from your own iCloud Photos library before import. These Apple services operate under Apple’s terms and privacy policy.

Lockleaf does not include an advertising identifier, third-party analytics or developer crash-reporting SDK. Any device diagnostics you choose to share with Apple are governed by Apple’s settings and policies.

If you email support, we receive your email address, message and attachments and use them to respond. Please send only the minimum needed: device/app versions and an error description are usually enough. Never send passwords, recovery keys, backup passwords or private originals. Use demonstration content and hide unrelated personal information in screenshots.

Lockleaf does not operate a registration service, build user profiles or knowingly solicit children’s personal information. The same local-storage design applies to every user; guardians should supervise device permissions and any external sharing as appropriate.

Because there is no developer-held copy of your vault, we cannot retrieve, inspect or erase its contents on your behalf. You control the vault on your device, the files you exported, and the Apple or file-provider accounts you chose.

For questions about this policy, email feedback@084817.xyz. We will update this page if the app’s data practices change. The date above identifies this version of the policy.