Privacy policy

Kura Vault is an end-to-end encrypted photo and video vault. Greytimelabs publishes the Kura Vault apps for Android and iOS, the web client at kura-app.greytimelabs.com, and this website. This policy explains what those clients do with your data.

Who holds your data

Kura Vault is a client. It connects to a Kura Vault server whose address you enter, and your account and encrypted media live on that server. Whoever runs the server, whether you, your family, your organisation or Greytimelabs, is responsible for the data stored there and for its own privacy terms. Greytimelabs has no access to servers it does not run.

Accounts are never open for anyone to sign up. Each one is created from an invite link issued by the server’s owner.

What the apps collect

Nothing for Greytimelabs. The apps contain no analytics, advertising, crash reporting or tracking of any kind, and they send data only to the server you connect to.

This website

kura.greytimelabs.com sets no cookies and loads no third-party fonts. It counts visits with Cloudflare Web Analytics, which does not use cookies or fingerprinting and reports only aggregate numbers, such as page views and referring sites. Like any web host, Cloudflare processes your IP address to deliver the page.

What the server receives

Your photos, videos, file names, location data, album names and vault names are encrypted on your device before they leave it. The keys come from passphrases that never leave your device, so the server operator cannot see your media, and neither can Greytimelabs or the storage provider.

To sort, share and authorise, the server does see:

• Your username, role and public keys.
• A one-way hash of your password, which is checked when you sign in. The password itself is not stored.
• For each photo or video: whether it is a photo or a video, its capture time, dimensions, duration, file size and who uploaded it.
• How many vaults, albums and items exist, and who they are shared with.
• When you sign in and what you request, as any web server does, including your IP address.

All of this travels over HTTPS. The apps accept plain HTTP only for servers on your local network.

What stays on your device

• Sign-in tokens, kept in the platform keystore and never in a device backup.
• Your keys, held in memory only, and erased when the app locks, closes or stays idle past the lock time you choose.
• If you turn on fingerprint or face unlock, your account key, encrypted by a hardware key that only your biometric can release. It is off unless you turn it on.
• Brief plaintext copies of photos you pick or take, deleted once they are uploaded or when the vault locks.

Permissions

• Internet, to reach your server.
• Photos and camera, through the system photo picker and camera app. The app sees only what you pick or take and never reads your photo library.
• Storage (Android 9 and earlier only), to save a photo to your gallery when you ask.
• Biometrics, only if you turn on fingerprint or face unlock.

A photo you save to your gallery or files is no longer encrypted, and other apps and cloud photo sync can read it.

Sharing

Greytimelabs does not sell, rent or share your data. Media is shared only with people you share a vault or album with on the same server, and only in encrypted form.

Retention and deletion

Data stays on the server until it is deleted. Deleting an item, album or vault erases it and its encrypted files from the server. Deleting an account erases the account and the vaults it created. See how to delete your account.

There is no passphrase recovery. If you forget your master passphrase, nobody, including the server’s owner and Greytimelabs, can recover what only your account could open.

Children

Kura Vault is not directed to children under 13.

Changes

If this policy changes, the new version is published on this page with a new date. Significant changes will also be noted in the app’s release notes.

Contact

Questions about this policy: [email protected]. For data on a server run by someone else, contact that server’s owner.