Privacy Policy

Draft for review. This text has not been approved and is not yet in force.

Bunker doesn’t collect the photos, videos, documents, notes or anything else you keep in it, and it has no account for you. Your vaults are encrypted on your device with keys we never receive, so we can’t read them, share them or hand them over. This policy explains the small amount of information that does pass through us or through Apple, and why.

Bunker is made and published by Ad Astra Studios (“we”, “us”), the data controller for the little information this policy describes. Ad Astra Studios is based in Mumbai, Maharashtra, India.

The short version

Your content: encrypted on your device. We never receive it.
Account: none. There is nothing to sign up for.
Ads and tracking: none. No advertising identifiers, no tracking across apps or websites.
Analytics: anonymous usage and crash counts, on by default, with one switch to turn them off (App Settings → Privacy → Share Anonymous Diagnostics). Never your content, never linked to you.
Support: if you email us, we have your email and what you wrote.
This website: sets no cookies and runs no analytics or ad scripts.

What stays on your device

Everything you add to a vault is encrypted on your device before it is stored, using keys derived from your Pattern, Passphrase or Recovery Phrase. File names, thumbnails, notes, text read from scans, and the names and notes you give trusted contacts are encrypted too. A few settings that don’t concern vault content (for example your theme, a count of the days you’ve used the app, and the name you show on shares and Legacy Cards) are kept on the device in the ordinary way. None of this is sent to us. How the encryption works is on the security page.

What is stored in your iCloud

If you use Encrypted Backup or Sync, Bunker stores encrypted copies of your vaults in your own iCloud account, in a private CloudKit database. Apple stores that data under Apple’s Privacy Policy. It is encrypted before it leaves your device, and neither we nor Apple can read it. Apple can see how much you store and when it was uploaded. Bunker also keeps small secrets in your iCloud Keychain, which Apple end-to-end encrypts.

You can delete a vault’s backup at any time by turning off iCloud backup in that vault’s settings, or delete all of Bunker’s iCloud data in your device’s iCloud settings.

When you create a share or a Legacy Vault (Bunker Pro), Bunker publishes an encrypted, read-only copy to CloudKit’s public database, a storage area Apple runs for the app. It can only be found and opened with the key in your share link or code, or with enough Legacy Cards. We can’t read it.

CloudKit marks each record with an anonymous identifier for the iCloud account that created it. It doesn’t tell us who you are, but it could show that two shares came from the same account.
A shared copy stays until you revoke it or it expires; a Legacy copy stays until you change or turn off that Legacy Vault. Deleting the vault removes them too. Erase Everything doesn’t remove shares or Legacy copies already published, so revoke them, or turn Legacy off, first.
When someone opens a share or a Legacy Vault, their app writes a small encrypted record (about 1 KiB) so you can see it was opened. It belongs to their iCloud account, so it may remain after you revoke the share.
Names of trusted contacts and any personal notes are printed on their Legacy Cards and stored encrypted in your vault. We never receive them, and no email address or Apple Account is needed for them.

Purchases

Purchases of Bunker Pro and Family Plans are handled entirely by Apple. We don’t receive your name, payment details or Apple Account. The app checks your purchase on your device using Apple’s signed records; we run no server for this. Apple gives us sales reports in App Store Connect, such as how many subscriptions were sold in each country, which don’t identify you.

Crash reports and diagnostics

If you’ve chosen to share analytics with app developers in your device’s settings (on iPhone: Settings → Privacy & Security → Analytics & Improvements → Share With App Developers), Apple may send us crash reports and diagnostics for Bunker. Apple collects these, and they don’t include your vault content. You can turn this off at any time in the same place.

Anonymous diagnostics

Bunker sends a small, fixed list of anonymous events so we can see whether the app works and what people use: the app opened, a vault opened (never which one), how many items an import brought in (in wide ranges such as “2–10”), a scan saved, a plan screen shown and where from, a purchase completed, a backup finished or failed, and that a crash or hang happened. That’s the whole list.

Never included: file names, file types, photos, notes, Patterns, passphrases, Recovery Phrases, vault names, counts per vault, or anything that identifies a vault or you.
Not linked to you: each install has a random ID that isn’t tied to your Apple Account or your device’s advertising identifier. It’s replaced if you turn diagnostics off and on, or erase Bunker.
Where it goes: PostHog, in the EU, as our processor. It’s set to discard IP addresses and not to look up location.
Turn it off: App Settings → Privacy → Share Anonymous Diagnostics. Nothing is sent while it’s off.
After a Duress Vault opens, nothing more is sent for the rest of that session.

When you contact us

If you write to [email protected], use Send Feedback (which opens your own Mail app), or report a security issue, we receive your email address and whatever you include. We use it only to reply and to fix problems, and we don’t add you to any mailing list. Please don’t send your Pattern, Recovery Phrase or Legacy Card words; we never need them.

This website

usebunker.app is a static website. It sets no cookies and runs no analytics or advertising scripts. Fonts and images are served from the site itself.

The hosting provider may keep standard server logs (such as IP address, browser type and the page requested) for security and reliability.
Links to the App Store pass through a short redirect (/go/app-store/) that adds a campaign label, so Apple can tell us how many installs came from each page. It doesn’t identify you.
The /s/ page for shared vaults reads the key from the part of the link after #, which browsers never send to a server, and removes it from your address bar at once.

Children

Bunker isn’t directed at children under 13, and we don’t knowingly collect information from them.

Your rights

Because we hold almost nothing about you, there is usually nothing to access, correct or delete. If you’ve emailed us, you can ask us to delete your messages, or ask what we hold, by writing to [email protected]. Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have further rights, including the right to complain to your data protection authority. We don’t sell or share personal information.

Changes to this policy

If this policy changes, we’ll update this page and the date at the top, and mention significant changes in What’s new.

Contact

Questions about this policy: [email protected]. See also the Terms of Use.