Ownlock privacy policy

Effective date: 23 October 2026. Last updated: 23 October 2026.

Ownlock is a photo and video vault for iPhone and Android. It is made by Calvin Holloway, an independent developer in the UK ("we", "us"), who is responsible for the small amount of personal data described here. Contact: [email protected].

The short version

• Everything you put in your vault is encrypted on your phone. It stays on your phone and, on iPhone, in your iPhone backups unless you turn that off (see "Backups and deleting your data"). We never receive your photos or videos, their details, your pattern, your recovery phrase or your keys.
• Ownlock has no accounts and no servers of its own. It shows no ads, it doesn't track you, and it contains no analytics, advertising or crash-reporting SDKs.
• When you open the upgrade screen, try to add items beyond the free limit or restore purchases, Ownlock uses a service called RevenueCat to check your purchases. RevenueCat then receives an anonymous ID, your purchase records and basic details about your phone. That, and on Android a copy of RevenueCat's anonymous ID that Google Play services can back up to your Google account or copy to a new phone (see "Purchases and RevenueCat"), is the only personal data the app sends anywhere.
• Apple and Google run the stores and take payments, under their own privacy policies. If you have allowed it in your phone's settings, they also give us crash reports and statistics that don't identify you.

What stays on your phone

• Your photos and videos, their thumbnails and previews, and their details (names, dates, sizes, location data inside the files) are encrypted on your phone with AES-256-GCM before they are stored. They stay on your phone and, on iPhone, in your iPhone backups (still encrypted) unless you turn that off.
• Your pattern, your recovery phrase and the vault's keys are never sent to us, and your pattern itself isn't stored anywhere. Some keys are kept in your phone's secure hardware (the Secure Enclave on iPhone, Android Keystore on Android) and never leave it. On iPhone, your backups include the vault's other keys and two copies of your recovery phrase, all encrypted: from a backup, only your recovery phrase can open them.
• Face ID, Touch ID and fingerprint or face unlock are checked by your phone itself, which tells Ownlock only whether they matched. Ownlock never receives your face or fingerprint data.
• A few settings that aren't encrypted, such as how many wrong patterns were tried, whether biometric unlock is on, and when your pattern last opened the vault, are kept on the phone so the app can work before the vault is open. We never receive them. On iPhone, Ownlock asks iOS to keep these settings out of backups, but whether biometric unlock is on, and when your pattern and phrase were set, can also be seen from the vault's own files, which are in your backups unless you turn that off.
• Access to your photo library. On iPhone, Ownlock imports through the system photo picker, which gives it no access to your library. It asks for add-only access to save items to Photos, and for full access only if you choose to delete originals after an import; what it reads then is compared on the phone and never sent anywhere. On Android, you choose files in Android's file picker and Ownlock asks for no access to your photos.
• What you export or share leaves the vault and goes where you send it, with its location and other details. We don't receive it.

What we never receive

We never receive, and have no way to see: your photos or videos; their names, dates, locations or other details; how many items you have; your pattern, recovery phrase or keys; or anything you do inside the vault. There is no copy of your vault on any server, so we can't recover it for you or hand it to anyone.

Purchases and RevenueCat

Upgrades are bought through the App Store or Google Play. Ownlock uses RevenueCat (RevenueCat, Inc., in the United States) to check purchases and tell the app whether you've upgraded.

When. The app starts RevenueCat only when you open the upgrade screen, try to add items beyond the free limit, or restore purchases, never at launch. Once started, it keeps running until the app is closed, and it contacts RevenueCat again when you come back to the app (if it hasn't for a few minutes), even if you don't open the upgrade screen again. Each contact tells RevenueCat that the app is installed and in use.

What RevenueCat receives:

• an anonymous ID that RevenueCat's software makes up for this installation of Ownlock (on Android it can carry over to a reinstall or a new phone, see below; we never give it your name, email address or any ID of ours);
• your purchase records from Apple or Google, such as the App Store transaction or the Google Play purchase token, which plan you bought, when, and its price and currency;
• basic details about your phone and the app: the phone's model and maker, the operating system and its version, the app's version, your language and region settings, and the country of your store account;
• on iPhone, the identifier iOS gives to apps from one developer on your phone (Apple's "identifier for vendor"), which RevenueCat's software sends with each request;
• on iPhone, whether Ownlock may ask to track you (Apple's tracking permission), which RevenueCat's software reads and sends itself. Ownlock never asks, so it can only say that Ownlock hasn't asked or isn't allowed;
• like any server your phone connects to, your IP address.

RevenueCat receives nothing about your vault. We have turned off its diagnostics. Its optional collection of device and advertising identifiers runs only when an app asks for it or connects RevenueCat to an advertising or attribution service; we do neither, so that collection never happens. We set no customer attributes.

Why, and on what legal basis. To confirm and restore your upgrade and to prevent fraud, because we need to do this to give you what you paid for (our contract with you). To give us reports such as how many people upgrade, cancel or ask for refunds, which we use to decide whether to keep developing Ownlock (our legitimate interests; you can object, see "Your rights"). You don't have to give us any personal data to use Ownlock: RevenueCat receives it only if you open the upgrade screen, try to add items beyond the free limit or restore purchases, and without it you can't buy or restore an upgrade.

Who else. RevenueCat processes this data only on our behalf, under a data processing agreement that requires it to keep the data secure and to use it only on our instructions to provide its service to us, so the data gets at least the protection this policy describes. RevenueCat stores it in the United States, on Amazon Web Services, and uses the other service providers ("sub-processors") listed in that agreement, all in the United States, for hosting, databases, network security, logging and error monitoring, reporting and AI services. Data from the UK is transferred under the UK Information Commissioner's International Data Transfer Addendum to the EU Standard Contractual Clauses, which RevenueCat's terms include.

RevenueCat's software also keeps a small record of your purchase status and its anonymous ID on your phone. On iPhone, this record can also be in your iPhone backups. On Android, once your purchase record shows an upgrade (bought or restored), RevenueCat's software also saves its anonymous ID in Google Play services' Block Store. Block Store can copy it to a new phone you set up from your old one. If Google Backup is on, Block Store also backs it up to your Google account (end-to-end encrypted only if your phone has a screen lock), keeps it after the app is deleted, and can copy it to a new phone set up from that backup. If you then restore purchases or buy an upgrade, RevenueCat links the new installation to the same purchase record. Ownlock doesn't turn this off: it is how RevenueCat's software normally works. Deleting the app deletes the record on the phone; the Block Store copy stays while Google Backup is on.

Apple and Google

• The stores. Apple (App Store) or Google (Google Play) handles downloading the app and paying for an upgrade, under its own privacy policy. We never see your card details. Apple and Google give us sales and download reports. Google's reports for a purchase include the order number and the buyer's country, and can include their state or postcode, and Google lets us look up an order if you give us the order number or your email address. We use these only for accounts, refunds and support (our legal obligation to keep accounts, and our contract with you).
• Crash reports and statistics. Ownlock has no crash-reporting SDK. If you have turned on "Share With App Developers" on iPhone (Settings, Privacy & Security, Analytics & Improvements), Apple may share crash reports and usage statistics with us, aggregated or in a form that doesn't identify you. If you have agreed to share usage and diagnostics data on Android, Google Play gives us crash and performance reports, broken down by things like app version, Android version, phone model and country. Ownlock never writes your photos, item names or keys into its own logs, so they aren't in these reports.

If you contact us

If you email us, we receive your email address and whatever you write, and use them only to reply and help you (our legitimate interest in answering you, or our contract with you for a purchase problem). We may count support emails by topic (for example "lockout" or "billing") to see what goes wrong, without keeping your details for that. Our support mailbox is hosted by Apple's iCloud Mail, so Apple stores support emails for us. We delete support emails 12 months after the conversation ends.

No ads, no tracking, no analytics SDKs

Ownlock shows no ads. It contains no analytics, advertising or crash-reporting SDKs. The only statistics we see are RevenueCat's purchase reports and Apple's and Google's own reports, described above. We don't track you across other companies' apps or websites, we don't sell or share your personal data for advertising, and we don't build profiles of you.

Backups and deleting your data

On iPhone. Your encrypted vault is included in your iPhone backups (iCloud or a computer) unless you turn off "Include in iPhone backups" in Ownlock's Settings. It is on by default. The backups are yours and Apple's; we never receive them. Apple can't read your vault inside a backup, but unless you've turned on Advanced Data Protection for iCloud, Apple could see how many encrypted files it holds, their sizes and dates. Ownlock asks iOS to keep its wrong-pattern counters and other phone-only settings out of backups (iOS treats this as a request, not a guarantee).

Deleting the app deletes your vault from the phone, and reinstalling the app doesn't bring it back. Copies in backups made before you deleted the app stay in those backups until the backups are deleted or replaced; the only way to get the vault back from one is to erase the iPhone and restore that whole backup. Turning "Include in iPhone backups" off keeps the vault out of later backups (Ownlock asks iOS to leave it out, and repeats that each time the vault opens), not out of earlier ones. iOS can also keep a few of the app's keys in the phone's keychain after the app is deleted; they are useless without the vault, and Ownlock deletes them if it is installed again.

On Android. Ownlock turns off Android's backup for its data and tells Android to leave all of it (the vault, its settings and RevenueCat's record on the phone) out of Google backups and phone-to-phone transfers. Some phone makers' own transfer tools may not follow those settings: anything they copy of your photos, videos and the vault's keys stays encrypted, but the app's settings and RevenueCat's record may be copied as they are. The exception is the Block Store copy of RevenueCat's anonymous ID described under "Purchases and RevenueCat", which Google Play services backs up and copies to a new phone separately. Deleting the app, or resetting the phone, deletes your vault for good.

Inside the app you can delete any item at any time, paid or not. Items go to Recently Deleted first and are deleted for good the first time you open the vault after 30 days, or straight away with "Delete now".

What we hold is RevenueCat's record of your purchases. Deleting the app doesn't delete it. To have it deleted, email us (see "Your rights"). If Ownlock is still on your phone, its next contact with RevenueCat can create a new record, so delete the app first; restoring purchases or buying an upgrade later also creates one. Deleting the record doesn't cancel a subscription: cancel that in your Apple Account settings or in Google Play.

How long data is kept

• RevenueCat's records: while Ownlock is offered, unless you ask us to delete yours sooner.
• Support emails: 12 months after the conversation ends.
• Apple's and Google's reports: as long as the stores keep them, under their policies.

Children

Ownlock isn't designed for children. It doesn't ask anyone's age and collects only the purchase data described above, from anyone. If you believe a child has bought an upgrade and want its RevenueCat record deleted, contact us.

Your rights

In the UK (UK GDPR). You can ask us for a copy of your personal data, and ask us to correct it, delete it, restrict or object to how we use it, or give it to you in a portable form. You can also complain to the Information Commissioner's Office (ico.org.uk). We answer within one month.

In the US. Depending on the state you live in (for example California, Virginia, Colorado or Connecticut), you may have the right to know what personal information we hold, to get a copy, to correct it or delete it, to appeal a refusal, and to opt out of its sale, of sharing for targeted advertising and of profiling. We don't sell or share personal information, use it for targeted advertising or profile you, so there is nothing to opt out of. We won't treat you differently for using any of these rights.

How to ask. Email [email protected]. Because the app has no accounts, we need something that lets us find RevenueCat's record of your purchase: the order ID from Apple's receipt email, or the order number (starting "GPA.") from Google Play's. We use it only to find and answer your request. For data Apple or Google hold, contact them directly.

This website

This website (ownlockapp.com) is hosted on Cloudflare Pages. When you visit it, Cloudflare receives your IP address and the details of your request so it can deliver the page and protect the site, under Cloudflare's own privacy policy. Cloudflare shows us only totals, such as the number of visits from each country, and, if its security features block a request, the details of that request, including its IP address. The site sets no cookies, runs no analytics scripts and loads nothing from other sites.

Changes to this policy

If we change this policy we will update the date at the top. If a change affects what leaves your phone, we will also say so in the app's update notes before it takes effect.

Contact

Calvin Holloway, the developer of Ownlock (UK): [email protected]