Account Vault Privacy Policy

Purpose#

This policy explains how information is handled in connection with your use of Account Vault, the macOS application for locally and securely managing credentials, passwords, and account information, published and operated by IMEDIATIS TECHLAB SARL. It supplements, where relevant, IMEDIATIS's general privacy policy, without replacing it.

Account Vault works on a fundamentally different model from IMEDIATIS's online products: there is no account, no server, and no synchronization involved. This policy describes that model as it actually exists in version 1.0 of the product — it does not describe any feature the app does not have.

Scope#

This policy applies to anyone using the Account Vault macOS application purchased or downloaded from the Mac App Store. It does not cover processing carried out independently by Apple Inc. in connection with distribution, payment, or the operation of the Mac App Store, nor does it cover IMEDIATIS's other products.

Definitions#

• App: the Account Vault software, as distributed on the Mac App Store.
• User: any person who installs or uses the app on a Mac.
• Vault: the structured set of credential entries, categories, providers, and environments a user creates within the app.
• Vault data: the information a user voluntarily enters into the vault, including account names, usernames, passwords, URLs, and notes.
• Local data: any data the app stores exclusively on the user's own Mac, including vault data, the modification history, backups, and preferences.
• Encrypted backup: an encrypted file the user generates on demand to duplicate the vault's contents, saved to a location of the user's choosing.
• CSV export: a plain, unencrypted tabular text file the user generates on demand for import or transfer purposes.
• Data collected by IMEDIATIS: information IMEDIATIS actually receives and holds, as distinct from local data, which stays on the user's device.

Data controller#

IMEDIATIS TECHLAB SARL, whose details appear in the legal notice, publishes and operates Account Vault. With respect to vault data, however, IMEDIATIS never acts as a recipient, custodian, or processor: that data remains under the user's exclusive, local control on their own Mac and is never transmitted to IMEDIATIS by the app.

Information entered and processed locally#

In the ordinary course of using Account Vault, a user may enter and locally store:

• account names;
• usernames;
• passwords;
• URLs;
• notes;
• categories, providers, and environments the user creates;
• an encrypted history of changes made to their entries;
• any other content voluntarily added to an entry.

This information is processed on the user's own device, by the app, solely to provide its functionality (saving, viewing, editing, deleting, searching, organizing). It is not "collected" by IMEDIATIS in any meaningful sense — IMEDIATIS has no access to it, never receives it, and cannot view it.

Information IMEDIATIS collects#

In its current version, the Account Vault app itself does not transmit any personal data or vault content to IMEDIATIS. There is no online account, no Account Vault server, and no synchronization mechanism that could relay this information.

That said, IMEDIATIS may receive information in two distinct situations, unrelated to the app's own operation:

• when a user voluntarily contacts support (category "Product support", with Account Vault preselected), in which case IMEDIATIS receives only the information the user chooses to include in that message;
• through Apple, which processes purchase, download, diagnostic, and App Store usage data under its own policies; IMEDIATIS may in turn receive commercial, aggregated statistical, or diagnostic information that Apple's policies permit it to share with developers — never the contents of any user's vault.

Purposes of processing#

Local data is processed by the app solely to deliver vault functionality: viewing, editing, deleting, searching and filtering entries, generating passwords, running a local security audit, maintaining the modification history, and performing backup, restore, import, and export operations.

Information voluntarily submitted through a support request is used by IMEDIATIS only to respond to the user and resolve the issue raised.

Legal basis#

IMEDIATIS does not process the contents of a user's local vault and accordingly relies on no legal basis for doing so — that processing is carried out entirely by the user, on their own device.

For information submitted through a support request or in connection with the commercial relationship (a Mac App Store purchase), the applicable legal basis depends on the nature of the request and may rest, as appropriate, on the performance of pre-contractual or contractual steps, IMEDIATIS's legitimate interest in supporting its products, compliance with applicable legal obligations, or the user's consent where information is shared voluntarily.

This policy has been drafted with regard to applicable Cameroonian law, including Law No. 2024/017 of 23 December 2024 on the protection of personal data, to the extent it applies to the processing IMEDIATIS actually carries out.

Local storage and security#

Vault information is stored locally on the user's Mac using SwiftData. Sensitive vault contents are encrypted locally using AES-GCM, implemented through Apple's CryptoKit framework. The master encryption key is protected in the macOS Keychain and is never transmitted to IMEDIATIS.

Access to the vault is protected by macOS's LocalAuthentication mechanism. Depending on the user's Mac hardware and configuration, the vault can be unlocked with Touch ID or the user's macOS password. IMEDIATIS never receives the user's biometric data or macOS password — these are handled exclusively by Apple and the operating system, entirely outside Account Vault and IMEDIATIS's reach.

No Account Vault server exists that could store, receive, or restore vault data.

These measures are designed to reasonably reduce the risk of unauthorized disclosure. They do not, however, amount to a guarantee of absolute security: no technical safeguard can fully rule out an incident arising from, among other things, compromise of the Mac itself, unauthorized physical access to an unlocked device, or a software vulnerability not yet identified.

Clipboard#

When a user explicitly chooses to copy a value (for example, a password), Account Vault uses the macOS general clipboard, which is shared across every application installed on the Mac. Until a copied value is cleared, another application running on the device could potentially read it.

The app lets users configure an automatic clipboard-clearing delay after a copy. This reduces the exposure window but cannot guarantee that no other application read the value before it was cleared.

Backups, restore, and CSV export#

Account Vault distinguishes between two kinds of files generated at the user's request:

• encrypted backups, created only when the user asks for one, saved to a location the user chooses, and protected using cryptographic mechanisms provided by macOS (including CryptoKit and CommonCrypto);
• CSV exports, which produce a plain, unencrypted file readable by any compatible software. The app displays a warning before generating this file.

In both cases, IMEDIATIS never receives a copy: these files are created, stored, and managed entirely by the user, at a location of their own choosing. The user is solely responsible for protecting, storing, transferring, and, where appropriate, deleting these files — particularly CSV exports, which contain credentials in plain text.

Files imported into the app are explicitly selected by the user. For this purpose, the app holds only the macOS "user-selected file — read/write" entitlement, strictly limited to what import, export, backup, and restore operations require.

Retention and deletion#

Local data is retained on the user's Mac for as long as the user does not delete it, the app is not uninstalled, or the device's data is not erased. Retention may also depend on how the Mac's own backup mechanisms behave (for example, Time Machine), which are outside Account Vault's control.

Because IMEDIATIS does not hold local data, it cannot view, modify, or remotely delete it. Deletion is always an action the user takes on their own device.

Information submitted to IMEDIATIS through a support request is retained separately, for as long as needed to handle the request and to comply with IMEDIATIS's applicable accounting or legal obligations.

Sharing and recipients#

IMEDIATIS does not share, sell, or otherwise disclose vault data to any third party — it simply has no access to it. No vault data is transmitted to a third party by the app.

The only recipient of information in the Account Vault ecosystem, besides IMEDIATIS itself, is Apple Inc., for anything relating to distribution, payment, and the operation of the Mac App Store, under Apple's own policies. Account Vault support is handled directly by IMEDIATIS TECHLAB SARL, with no external provider: information a user shares in a support request is not passed on to any third party. If a support provider or technical processor were ever introduced, this policy would be updated before that change took effect.

International transfers#

Account Vault does not transfer vault data, because no such transfer takes place. Support requests are handled directly by IMEDIATIS TECHLAB SARL in Cameroon, with no external provider involved. Only processing carried out independently by Apple in connection with the Mac App Store may take place through Apple's own infrastructure and locations, which may be outside Cameroon, under Apple's own safeguards.

Your rights#

For local vault data, users exercise direct, ongoing control through the app's built-in functionality: viewing, editing, deleting, and exporting let a user access, correct, or erase their data at any time, without needing to contact IMEDIATIS.

For information IMEDIATIS actually holds (for example, in connection with a support request), users may exercise the rights available under applicable law by contacting IMEDIATIS through our contact form (category "Data privacy").

Children#

Account Vault is not specifically directed at children and is not designed to collect information about minors. It is distributed on the Mac App Store under the age rating Apple assigns to it. Individuals who lack the legal capacity to accept the applicable terms of use should not use the app on their own.

Changes to this policy#

This policy may be updated to reflect changes to the product. Any material change will result in a new version, published with an updated revision date.

The absence of data collection by Account Vault described in this policy reflects the architecture of the current version and is a condition that must be verified for every new version released. If a future version of Account Vault were to introduce telemetry, crash-reporting tooling, a user account, cloud synchronization, an analytics tool, advertising, or any other form of data collection or processing by IMEDIATIS or by a third-party component, that introduction would first trigger a review of the corresponding App Store App Privacy declaration, this privacy policy, and, where relevant, Account Vault's terms of use — before the feature became available.

Contact#

Questions about this policy can be sent through our contact form, category "Data privacy" or "Product support" (Account Vault preselected). To protect your own information, please avoid sending support passwords, encryption keys, or unredacted copies of your vault.

Version history#