These are our commitments to you -- on privacy, pricing, and what it means to trust an app with access to your photo library.
The app analyzes your photos using AI models that run entirely on your iPhone. Nothing is uploaded. Nothing is transmitted. No photo data hits any server -- ours or anyone else's.
What we do store on-device: a metadata record of what the AI found (confidence scores, categories, timestamps). This is a vault of findings about your photos -- not a vault of your photos. We use the word "vault" deliberately in that sense.
What reaches our servers: subscription status (via Apple's IAP infrastructure), anonymous crash reports if you opt in. That is the complete list.
Vault: Privacy Guardian was built by a software engineer who shipped GDPR compliance and ISO 9001 quality processes at Uber. The architecture here reflects that background -- not aspirationally, but operationally.
On-device means on-device. We do not have a back door. We do not have a "feature" that uploads for better results. The AI models are bundled in the app binary. They run on Apple's Neural Engine. They have no network path.
When we find gaps in our privacy posture, we document them and close them. We test claims. We verify what we ship. The changelog reflects this -- version notes describe what was broken and how it was fixed, not just what was added.
If you subscribed before v1.1.0, you are a Founding Member. Your original subscription price is grandfathered for as long as you remain subscribed. You will never be bumped to a higher price without explicitly canceling and resubscribing.
This is not a temporary promotional promise. It is the way this app works. People who took a chance on Vault early -- back when it was called Skin Vault -- get the benefit of that trust reflected back at them. The prices shown on the pricing page are for new subscribers joining after v1.1.0.
If you cancel your subscription and rejoin, you re-enter at current pricing. The lock applies to continuous active subscribers.
If recurring payments make you nervous, they should not be a barrier to protecting your privacy. Buy-once token packs let you pay for exactly what you need, when you need it, with no ongoing commitment.
The Peek unlock is a one-time non-consumable purchase -- you buy it once and it is yours permanently, restorable on any device with the same Apple ID. It shows you your four highest-risk detections without subscribing.
Video analysis, which previously required the Bundle subscription, is now also available as a standalone buy-once pack. This reflects a deliberate choice: features that were subscription-gated should become accessible to people who do not want subscriptions as the product matures.
The detection system uses two layers: Apple's SCA (Sensitive Content Analysis) as a fast prefilter, and our ONNX YOLO models for scored per-frame detection. SCA is binary -- it flags or does not flag. Our ONNX models produce confidence scores, which is why you see percentages in results.
We are methodical about the gap between "we added this feature" and "this feature is verified to work correctly." The version notes on the changelog page reflect this -- when something had a bug, we say what it was.
We do not claim accuracy figures we cannot support. The "dual-layer" architecture meaningfully reduces false negatives, but no detection system is perfect. The confidence scores tell you how certain the model is. Review results with that in mind.
If we discover a privacy issue, we disclose it. If a scan result was wrong in a way that could have misled you, we say so. If a feature shipped broken, it goes in the changelog with an honest description.
This is the standard we hold ourselves to. Not a legal standard -- a professional one. The kind that comes from having shipped production software at organizations with real accountability processes, and bringing that discipline to an independent app.
Questions, concerns, or issues: support@linked.skin