Privacy Policy

Last updated 26 October 2026

Hushroll is made by Plainwren. This policy explains what happens to your photos, videos, documents and other information when you use Hushroll.

The short version

We don’t collect any data. Hushroll has no account, no analytics, no ads, no tracking and no servers of ours. Your vault is encrypted on your iPhone, and nothing leaves your iPhone unless you turn on iCloud backup, which uploads only encrypted data to your own iCloud. The App Store privacy label for Hushroll is “Data Not Collected”.

Your vault

Photos, videos and documents you add to Hushroll, their thumbnails, and the vault’s album names, file names and dates are encrypted on your iPhone with a random key that belongs to your vault. Your vault passcode and your recovery key each unlock that key. Hushroll never writes your decrypted photos or documents to storage, and vault files can’t be read while your iPhone is locked.

We never have your passcode, your recovery key or your vault key, so we can’t open your vault and can’t recover it for you. If you lose both your passcode and your recovery key, nobody can open the vault, including us.

Permissions

Hushroll asks only for what a feature needs, when you first use it:

• Photos: to import the photos and videos you choose. After importing, Hushroll offers to delete the originals from your photo library. iOS asks you to confirm, then keeps them in Recently Deleted for up to 30 days unless you empty it.
• Camera: to take photos straight into the vault. They are never saved to your photo library.
• Face ID (optional): to unlock the vault instead of typing the passcode. Face ID is handled by iOS and your iPhone’s Secure Enclave. Hushroll never receives your face data.

Documents you import from Files stay where they were in Files. Hushroll doesn’t delete them.

iCloud backup (optional)

iCloud backup is off until you turn it on in Hushroll’s Settings. When it’s on, Hushroll uploads your vault to the private database of your own iCloud account using Apple’s CloudKit. It uploads only encrypted data: the encrypted photos, videos and documents, the encrypted catalogue, and a copy of the vault key locked by your recovery key. Your passcode is never uploaded.

Apple stores this data, and we have no access to your private iCloud database. Without your recovery key, the data can’t be decrypted by anyone, including Apple and us. Apple can see how many items are stored, how large they are and when they changed, but not what they are. You can delete the iCloud copy from Hushroll’s Settings when you turn iCloud backup off.

Device backups

Your iPhone’s own backup (iCloud Backup, or a backup to your computer) can include Hushroll’s vault files. They are the same encrypted files as on your iPhone. To restore a vault from a backup onto a different iPhone, you need its recovery key.

Purchases

Hushroll Premium is sold through the App Store. Apple handles the payment, and we never see your payment details or your Apple Account. Hushroll checks what you’ve bought on your iPhone using Apple’s StoreKit.

Crash reports

If you’ve turned on Share With App Developers in iOS Settings (Privacy & Security > Analytics & Improvements), Apple may share crash reports and basic usage statistics with us. Apple doesn’t identify you in them, and they never contain the contents of your vault. We use them only to fix problems. You can turn this off in the same place at any time.

Children

Hushroll doesn’t collect information from anyone, including children.

Your rights

Because we don’t collect or hold any of your data, there’s nothing for us to access, correct, export or delete. Your vault is on your iPhone, and in your own iCloud if you turn on iCloud backup. If you have a question, email us.

Changes to this policy

If Hushroll changes how it handles information, we’ll update this page and the date at the top before that version is released.

Contact

Email support@plainwren.com.