Privacy Policy
Effective · Last updated
1. Who we are
EN PLACE AD S.R.L. (“we”, “us”, “our”) makes Locked, the private photo, video, file and note vault for iPhone and iPad, and is the data controller for the little personal data described in this policy.
| Company | EN PLACE AD S.R.L. |
| Registered office | Str. Regina Maria nr. 14D, Cluj-Napoca, Județul Cluj, Romania |
| Trade Register | J2018002711129 · EUID ROONRC.J2018002711129 |
| Tax ID (CUI) | 39521926 |
| contact@fabelx.com |
Privacy questions and rights requests: contact@fabelx.com. We have not appointed a Data Protection Officer; the address above is the contact for everything about your personal data.
2. The short version
- Locked has no account. No sign-up, no email, no name, no phone number.
- Your vault never reaches us. Photos, videos, files and notes are encrypted on your device before they are saved. We have no copy and no key.
- No analytics, no crash reporting, no ads, no tracking. Locked contains no analytics or advertising SDK and does not use the advertising identifier.
- iCloud Sync is optional and sends only encrypted files to your own iCloud Drive. Neither Apple nor we can read them.
- The one thing a third party receives is your purchase history, under a random ID, through RevenueCat, so Locked Pro works across your devices and we can see how many people buy it.
3. What Locked handles, and where it stays
3.1 Your vault: photos, videos, files and notes
Everything you put in a vault is encrypted on your device, with keys derived from your pattern or password and a secret kept in your device’s Secure Enclave, before it is written to storage. It stays on your device unless you turn on iCloud Sync (§3.2) or send a copy (§3.4). We never receive it. Text and scene recognition for search run on your device, using Apple’s on-device frameworks.
3.2 iCloud Sync (optional, Locked Pro)
When you turn sync on, Locked copies the same encrypted files to Locked’s folder in your own iCloud Drive, and from there to your other devices signed in to the same Apple Account. Apple stores those files under its own privacy policy; they are encrypted before they leave your device, so neither Apple nor we can read them. Your recovery phrase’s encrypted copy of the vault key travels with them, so the twelve words can open the vault on a new device. Turning sync off leaves the files in your iCloud Drive; deleting a vault removes its files.
3.3 Intruder photos and the tries count
If you turn on intruder photos, Locked uses the front camera to take a photo when someone enters a wrong pattern or password. The photo is encrypted on your device, is never uploaded and is kept out of iCloud Sync. The count of wrong tries and the intruder log also stay on your device.
3.4 Copies you send
When you send a copy of an item, Locked makes one encrypted file and hands it to the app you choose, such as AirDrop, Messages or Mail. Only the twelve words you pass on separately open it. Locked never receives the file; the app you choose and the person you send it to handle it under their own terms.
3.5 Camera and Photos permissions
The camera is used only when you take a photo or video straight into the vault, and for intruder photos if you turn them on. Access to your photo library is used only to remove originals you have just imported into the vault, after iOS asks your permission. Both permissions can be withdrawn at any time in iOS Settings.
3.6 Settings on your device
Settings such as auto-lock, appearance, language and the lock-screen mode are stored on your device only.
4. Locked Pro: purchases
Apple handles payment for Locked Pro under its own privacy policy; we never see your name, Apple Account or payment details.
To unlock Pro on all your devices and to report on sales, Locked uses RevenueCat, Inc. (United States). RevenueCat receives your purchase history (which product, when, renewals, trials, refunds and cancellations) under a randomly generated ID that is not linked to your name, email or Apple Account. Locked switches off RevenueCat’s collection of device identifiers and sends no customer attributes. As with any server your device connects to, RevenueCat also sees technical connection data such as your IP address, device model, iOS and app version and App Store country. Your vault data is never sent to RevenueCat.
5. Why we process it, and our legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Purchase history under a random ID | Giving you Locked Pro on all your devices and restoring purchases | Performance of a contract (Art. 6(1)(b)) |
| Purchase history under a random ID | Counting sales, trials and renewals so we can run and improve Locked | Our legitimate interest in understanding our business (Art. 6(1)(f)) |
| Technical connection data seen by RevenueCat | Delivering and securing the purchase service | Our legitimate interest in a working, secure service (Art. 6(1)(f)) |
Everything in §3 is processed only on your device or in your own iCloud Drive, under your control; we do not receive it, so it is not processed by us.
We make no automated decisions with legal or similarly significant effects on you, and we do not profile you.
6. Who we share data with
- RevenueCat, Inc.: purchase history and technical connection data, as in §4, under RevenueCat’s Data Processing Addendum. Transfer: United States, see §7.
- Apple: as the App Store and, if you turn on sync, as your iCloud provider, under Apple’s own privacy policy. Apple receives only encrypted vault files from Locked.
- Other disclosures: we may disclose data where the law requires it (a court order or other lawful request), to establish or defend legal claims, or to a successor in a merger or acquisition, in which case this policy keeps applying until it is replaced and we will tell you.
We do not sell or rent personal data, and we do not share it for advertising.
7. International transfers
RevenueCat processes data in the United States. Transfers rely on the European Commission’s Standard Contractual Clauses and, where the recipient is certified, the EU-U.S. Data Privacy Framework. You can ask us for a copy of the safeguards at contact@fabelx.com.
8. How long we keep it
- Vault contents, intruder photos and settings: on your device and, with sync on, in your iCloud Drive, for as long as you keep them. Deleting a vault deletes its files; deleting Locked deletes its vaults on that device.
- Purchase history at RevenueCat: for as long as you use Locked Pro, and afterwards as long as needed for accounting, tax and legal obligations, then deleted or anonymised.
9. Deleting your data
Because there is no account, there is nothing to close. To remove everything:
- Delete the vaults you no longer want inside Locked, or delete the app.
- If you used iCloud Sync, remove Locked’s data from iCloud in Settings → [your name] → iCloud → Manage Storage.
- To have your purchase history deleted at RevenueCat, email contact@fabelx.com (see §10).
10. Your rights
Under the GDPR you have the right to access your data, have it corrected or erased, restrict or object to processing based on legitimate interests, and receive it in a portable format (data portability).
To exercise them, email contact@fabelx.com. Because Locked has no account, we cannot find your purchase history from your name or email alone; include your App Store order ID (from your purchase receipt email or Report a Problem) so we can locate it. We answer within one month (extendable by two further months for complex requests, with notice). Exercising your rights is free unless a request is manifestly unfounded or excessive.
Complaints. You may lodge a complaint with the Romanian supervisory authority:
Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania anspdcp@dataprotection.ro · www.dataprotection.ro
You may also complain to the authority in your own EU country of residence.
If you are in California (CCPA/CPRA). We collect only the purchase history and technical data in §4, for the purposes in §5. We have not sold or shared personal information, including that of anyone under 16. You have the right to know, delete and correct it, and not to be discriminated against for exercising these rights; contact contact@fabelx.com. You may use an authorised agent.
11. Children
Locked is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has bought Locked Pro and want the purchase history deleted, contact contact@fabelx.com.
12. Security
Vault data is encrypted on your device with AES-GCM, using keys derived with Argon2id from your pattern, password or recovery phrase and, for pattern and password, a secret held in your device’s Secure Enclave. We never hold your keys, so we cannot open your vault, recover a forgotten pattern or password, or hand your content to anyone. Only your recovery phrase can open a vault without its pattern or password: keep it somewhere safe.
No system is perfectly secure. If a breach of the data we do process (§4) affects your rights, we will notify the supervisory authority within 72 hours and you directly where the law requires it.
13. Changes
We may update this policy. The “Last updated” date will change, and for material changes we will tell you in the app before they take effect.
14. Contact
EN PLACE AD S.R.L. Str. Regina Maria nr. 14D, Cluj-Napoca, Județul Cluj, Romania contact@fabelx.com
This website
This policy also covers lockedvault.app, the website you may be reading it on. The sections above describe the app; this section describes the site.
The site is a set of static pages. It sets no cookies, runs no analytics, advertising or tracking scripts, and has no forms. Everything a page needs is served from this domain, which is also why you are not asked to accept anything.
Our hosting provider, Cloudflare, Inc., processes your IP address in order to serve the page to you, and may retain it briefly in its own security logs. Nothing about your visit is recorded by us.