SecondLock Privacy Policy

Last updated: October 27, 2026 Where the App is distributed: Japan

The short version

SecondLock ("the App") collects nothing about you.

Most privacy policies explain what a company does with the data it collects. This one exists to explain that there is no collected data to describe, and why.

One thing sits outside that sentence. The support page is not part of the App — it is a web page. If you write a contact address into a message there yourself, we receive it. The App does not collect it, but we still receive it, so section 10 says how we handle it.

1. What we don't collect

The App does not collect any of the following:

The App contains no third-party SDKs for advertising, analytics, attribution or crash reporting. The App shows no advertising of any kind, including on the free tier. Nothing about you is sent to any other company.

2. The photos and videos you store

1. Photos and videos you add are encrypted on your iPhone before they are written anywhere.
2. The encryption key is generated by the App and protected by the PIN you choose. We do not hold that key.
3. Therefore we cannot read what you store. This is not a policy we could change our minds about; it is how the software is built.
4. On a paid plan, the encrypted data is stored in your own iCloud account. We never hold your data.
5. The data is still encrypted when it reaches iCloud. We run no servers and never touch the encrypted data or the key.
6. So that you can recover on a new device, the information needed to rebuild the key from your PIN is also stored in iCloud. The key wrapped by your PIN is stored in encrypted form. The ingredients for rebuilding it (the salt and the iteration count) are stored without the App's own encryption; on their own they reveal neither the key nor your PIN. Your PIN itself is never stored.
7. The photos themselves, thumbnails, Live Photo motion and album names are stored encrypted. Accompanying details such as the capture date, the type (photo or video), the size, the pixel dimensions, the video length, the file format, the identifier of the album an item belongs to, the deletion date, and the order and creation date of albums are stored in iCloud records without the App's encryption. Any encryption iCloud applies at rest is Apple's mechanism, separate from the App's own.

3. We do not sell or share your personal information

We hold no personal information, so there is none to sell, share, or use for targeted advertising. We have never done so and have no mechanism to do so.

Because we collect nothing, requests to know, delete, correct, or opt out have nothing to act on — but you may still contact us at the address in section 10.

4. The App never talks to a server of ours

The App never communicates with a server operated by us.

Network traffic from the App happens in exactly two situations:

• With your own iCloud (through Apple's CloudKit)
• With the App Store (to check your purchase status; handled by Apple)

Both are between you and Apple. We are not in the middle of either.

We run no servers

We currently operate no server of any kind for this App.

In some places, laws about minors require a developer to be able to receive notice that a parent has withdrawn consent. We do not sell the App in the places that require one. The App also collects nothing about you and has no accounts, so there is no consent to withdraw in the first place.

If we ever sell the App where one is required, we will update this policy before that distribution begins. Even then, the only thing that would pass through such an endpoint is Apple-signed information about which app, which kind of notification, and when. No photos or videos would pass through it — not even encrypted ones. No encryption key would pass through it; we don't have one to begin with. Nothing identifying you would pass through it; the App has no accounts.

5. Access to your photo library

1. When you add photos or videos, the App does not request access to your photo library. It uses the iOS photo picker, which runs in a separate process, and receives only the items you select. The App cannot see the rest of your library.
2. The one exception is the "Delete Originals" feature. If you choose it, the App asks for photo access at that moment, and uses it only to delete the originals you selected. It is never requested at launch or during setup.
3. The App asks for permission to add to your photo library (add only) only when you choose "Save Image" for a Live Photo. This permission does not let the App see your library; it is used only to save the Live Photo you chose to the Photos app.

6. Notifications

If the App sends you a notification, the notification never contains anything about what you have stored — no counts, no album names, no dates.

7. Disclosure to others

We hold no personal information collected through the App, so there is nothing to disclose to anyone.

This includes requests from law enforcement. We hold neither information identifying you nor the contents of your vault. There is nothing we could hand over, in any country, under any legal process. The one exception is what you send us through the contact page, which is covered in section 10 (we do not pass it to anyone except where the law requires it).

8. Your control over your data

1. You can delete stored data at any time from the App's settings.
2. Deleted items stay in "Recently Deleted" for 30 days. After that, an item is removed from your iPhone the next time you open and unlock the App, and from iCloud at that moment if the App has a connection. We have no server that deletes anything on a schedule. While the App is not opened, or has no connection, the item remains in iCloud in encrypted form.
3. "Delete All App Data" skips "Recently Deleted": it deletes the iCloud copy first and then destroys the data on your iPhone and your PIN. If the iCloud copy could not be deleted, it stops and tells you.

9. Children

The App is not directed to children under 13, and we do not knowingly collect personal information from anyone — including children — because, as described above, we collect no personal information from any user at all.

10. Contact

https://illustrious-dasik-b7f883.netlify.app/en/support/

Use the page above to reach us. There is no contact form inside the App — putting one there would tie your vault to your message, which we have chosen not to do.

The form on that page is a Google Form. To be exact about it:

• There is no email address field. The only thing stored is what you type into it yourself.
• If you want a reply, put a contact address in the message yourself. It is optional — without one, we have no way to reach you.
• What you submit is stored on the servers of Google LLC (United States) and read by us. We cannot tell which country those servers are in. Google's own privacy policy also applies to it.
• The form is not connected to your vault, your encryption key, or the App in any way. Contacting us does not give us the ability to see what you have stored.

What we use it for: only to answer you and to investigate and fix the problems you report. We do not use it for anything else, and we do not pass it to anyone else except where the law requires it.

How long we keep it: for as long as answering you and investigating the report requires, after which it is deleted. If you want it deleted sooner, tell us through the same contact page (include when you sent it and part of what you wrote, so we can find it). Only we read it.

11. Changes to this policy

If this policy changes, we will give notice inside the App and on our distribution page. If we ever change what information is collected, we will say so explicitly before the change takes effect.