Privacy Policy

Summary

In the Tresory app and on this website we only collect data that a feature really needs. There is no advertising, no ad trackers, no analytics services and no sale of or trade in user data. Development, operation and data are located in Germany.

Your pictures are stored in the app's protected folder on your device, not in the photo library. You need an account to use the app. The Cloud Vault backs up your photos and documents on servers in Germany as long as there is free space in your storage. It can be switched on and off. Transfer and storage are strongly encrypted.

1. Scope and legal bases

This policy applies to the website tresory.app and to the Tresory app. For the other services of Neumeister Media, the privacy policy at www.neumeistermedia.com/datenschutz applies. Section 10 states who is responsible and how to reach us.

We rely on the following legal bases: contract, Art. 6(1)(b) GDPR (use of the app), legitimate interest, Art. 6(1)(f) GDPR (security and operation), consent, Art. 6(1)(a) GDPR (where we ask for it) and legal obligation, Art. 6(1)(c) GDPR (for example tax retention).

2. Hosting and server log files

This website is hosted by a hosting provider in Germany. The provider supplies servers, storage space and security functions. We have a data processing agreement with the provider pursuant to Art. 28 GDPR. We will name the provider on request. The legal basis is Art. 6(1)(f) GDPR, our interest in a secure and efficient operation of the website.

Each visit technically requires the processing of access data (server log files): the page or file requested, date and time, amount of data transferred and status message, browser type and version, operating system, referrer URL (the previously visited page), IP address and requesting provider. We use this data for the operation, security and optimisation of the website. If there are concrete indications of unlawful use, we review the logs retrospectively. We store log files only as long as necessary for these purposes, and longer only to investigate a security incident.

3. Cookies and web analytics

Visitors to the website do not receive any cookies. We do not use analytics, marketing or social media services, do not embed third-party content and do not load external fonts. All fonts and images are served by this website itself. The demonstrations on the page (PIN field, image filters) run entirely in your browser; nothing is transmitted. The website is available in several languages. If you arrive at a German page from outside, a small script in your browser checks your browser language and redirects you to the matching language version if appropriate. Nothing is stored and nothing is sent to us. Only those who log in to the website's administration area (operators) receive a technically necessary session cookie (§ 25(2) no. 2 TDDDG).

The buttons for the App Store and Google Play are simple links. Once you click, the privacy policies of Apple or Google apply.

4. Contacting us

If you write to us by email, call us or use the contact form at tresory.app/kontakt, we process your details to handle the request and answer follow-up questions. With the contact form, these are your email address, the selected topic, your message and, if you provide it, your name. The form stores nothing on the website: your details are transmitted encrypted (TLS) to our mailbox at our hosting provider and handled there like an email. The legal basis is Art. 6(1)(b) GDPR (request relating to a contract) or (f) GDPR (general requests). We delete the data as soon as the request has been dealt with and no retention obligation applies. We keep business correspondence for up to six years (§ 257 HGB, § 147 AO).

5. Data protection in the Tresory app

We are the controller within the meaning of the GDPR for your data in the app.

On your device. Photos, videos, documents and albums are stored in the protected app folder and in a local database. We never store the PIN in plain text, only as a verification value in the device's secure storage (Keychain or Keystore). Face ID and fingerprint are checked by the operating system; the app only learns “yes” or “no”. The decoy vault, the demo and the intruder photos remain exclusively on the device and are never transmitted. The security album is additionally protected by Face ID, fingerprint or the PIN, each time it is opened; its content is backed up like your other albums. Editing images, creating PDFs and scanning documents happen on the device; nothing is sent for this. So that chats open immediately and also without internet, the app stores the most recently loaded messages (up to 50 per chat, for no more than 30 days) and the chat list in this database. They are removed when you sign out, delete your account or empty the vault.

Account. To use the app, you create an account with an email address and password. We only store the password in protected form (hash). For shared albums and one-time photos you choose a username by which others can find you. Others cannot see your email address. Optionally, you can add a second email address as an emergency address so you can get back into your account if you lose access to your mailbox. We store it until you remove it or delete your account, together with a check value (hash) of the confirmation code and the time of any request for emergency access. When such a request is made, we write to both addresses; access is only granted after a waiting period of 7 days, and you can cancel the request at any time. The legal basis is your consent given by setting it up (Art. 6(1)(a) GDPR), which you can withdraw at any time by removing the address. The legal basis is the user agreement (Art. 6(1)(b) GDPR). We send confirmation, password and emergency emails via the email server of our hosting provider in Germany.

Cloud Vault. The Cloud Vault backs up your photos and documents and, if you wish, can offload originals. The app also syncs albums and photo details between your devices. Backups run as long as there is free space in your storage. If it is full, new photos and documents are no longer backed up; albums and details continue to be synced. We transfer albums, photo details (name, size, format, date taken, album), the photo files and their thumbnails. We only back up videos with a paid subscription (Plus, Pro or Max) and only while “Back up videos” is switched on in the app. On the Basic plan they stay on the device. The data is stored in a private area of your account that only your account may access. We additionally encrypt the data at the server provider, so that the provider sees no data in plain text. Content is only evaluated where there is a legal obligation. Offloading originals is optional and can be switched off in the settings. The backup is not affected. Account, database and sign-in are hosted by a service provider in a data centre in Germany. The files (photos, thumbnails, one-time photos and attachments) are stored in a data centre in Germany at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. We have data processing agreements with both service providers. Insofar as the database provider has group companies outside the EU (USA), any transfer is based on EU standard contractual clauses. We will name the database provider on request.

Shared albums. People you invite to an album can see its pictures and, depending on the setting, add their own once the invitation has been accepted. You can revoke access at any time. Pictures added by others remain in their own storage. If an album has sub-albums, you decide when inviting whether they are shared too. Everyone who can see a shared album can also see who is in it: the username of the person who owns it and of the members who have accepted. Only the owner can see pending invitations.

One-time photos, chat and attachments. A one-time photo can be viewed by the recipient exactly once. Until then it is held temporarily on the server. The file is deleted 7 days after viewing; a photo that is never opened expires after 7 days. In the app, screenshots are blocked for this as far as the device allows. We store messages and one-time photos between two users on the server so that they arrive. In the chat you can also send photos and documents (up to 25 MB) and voice messages (up to 5 minutes) as attachments. For a voice message we transmit its duration and a waveform (bar heights only, no sound). We do not analyse voice messages or convert them into text. We reduce the size of photos beforehand. Attachments are stored in the sender's area on the server and count towards their storage. Messages and attachments can only be read by the two participants. For each message we store when it was delivered (picked up by the recipient's app) and when it was read. Whether the sender sees “read” depends on read receipts: they can be switched off in the settings and apply mutually. If either person has switched them off, the sender only sees “delivered”. For each chat, the sender decides how their one-time photos arrive: with “Strict” (default), the server only releases the photo when the recipient taps it. With “Fast”, the recipient's app downloads the photo in the background as soon as it arrives and stores it invisibly in its app folder until it is tapped. After viewing, it is deleted there. You can delete your own messages for both sides. The conversation then only shows the note “Message deleted”, and nobody can retrieve the content any more. On the server we keep the text, attachment and one-time photo for another 30 days so that we can investigate reports of abuse and evidence does not disappear beforehand. The legal basis is our legitimate interest and that of the persons concerned in a safe platform (Art. 6(1)(f) GDPR). If you mark messages as favourites, we store this marking with your account. The other person cannot see it. You can also delete messages only for yourself (those of the last hour, the last day or all). They then only disappear from your view. The other person keeps their copy, and the messages remain unchanged on the server. Before that, the app saves photos and documents from these messages in your vault (album “Chat photos”, folder “Chat files”), but never one-time photos. You can react to messages with one of six emojis. Only the two participants see the reaction; it is deleted when you withdraw it, and together with the message or the account. For each chat you can set new messages (except one-time photos) to disappear after 1 hour, 1 day or 7 days. Both people see in the chat who changed the time limit. Once it expires, the message disappears from the chat for both, and an attachment can no longer be retrieved. On the server we treat it like a message deleted for both sides, so it remains as evidence for another 30 days (see retention period). In the chat you can pixelate photos or add stickers before sending. This happens on your device; your original in the vault remains unchanged. We store a caption (up to 500 characters) like a text message; the same time limits apply.

Group chats. In a group we store on the server the group name, description and picture, the members with their role (admin or member) and the period of their membership, the messages, attachments and one-time photos, and who has received, read or opened a message. Only people who were members when a message was written can read it: anyone who joins later sees nothing from before; anyone who leaves or is removed sees the history up to then, but nothing new. Anyone who turns off read receipts does not appear in the “Read by” list. If you delete your account, your messages, photos and documents in groups remain available to the other members and appear as “Deleted account”; your username and ID are then no longer linked to them. In one-to-one chats everything is still deleted with the account. If you do not want that, choose “Delete account and group posts” in the app when deleting (without the app: write to us, see “Delete account”); we then delete your contributions in groups for all members. They stay stored for another 30 days as evidence for reports and are then permanently removed. An admin can invite people who are not your friends by username; they see nothing from the group until they accept. The legal basis is the use of the app (Art. 6(1)(b) GDPR); that your contributions remain available to the other members after an account deletion is based on our legitimate interest and that of the other members in complete conversation histories (Art. 6(1)(f) GDPR).

Friends. Using the username, you can send other users a friend request. We store who sent a request to whom, whether it was accepted and when. A friendship can only be seen by the two people involved. The friends list is used for quick selection in the chat, when sharing albums and for one-time photos. We do not access your address book and do not match contacts. The legal basis is the use of the app (Art. 6(1)(b) GDPR).

Profile picture and status. You can optionally add a profile picture and a short status (up to 80 characters). The picture is resized in the app and stored encrypted in the Cloud Vault like your other files; it does not count towards your storage. You decide who sees picture and status: your contacts (friends and people you already chat with, the default), all users who know your username, or nobody. Blocked people never see either. If someone reports you, we store your current profile picture as evidence together with the report. The legal basis is the use of the app (Art. 6(1)(b) GDPR).

Devices. So that you can see where your account is signed in, each installation of the app registers with a random identifier, the device model (for example “iPhone 15 Pro”), the platform (iOS or Android), the time of sign-in and of last use, and an identifier of the sign-in session. We do not store IP addresses or locations for this. In the app you can sign out other devices. The legal bases are the use of the app and the security of your account (Art. 6(1)(b) and (f) GDPR).

Expiry date. You can set an expiry date for documents and photos, for example for an ID card. We store the date with your account, like the file name or favourite, so that it is the same on all your devices. Your device creates the reminders itself as a local notification. The document's name is not included, and nothing runs through our server or a push service.

Sharing without location. When you share photos from the vault, the app removes location and camera data (Exif) on your device beforehand by default.

Reporting and blocking. If you report a person, we store the last 20 messages of the conversation as evidence and review them. In doing so, we may also view attachments and one-time photos from the reported conversation. We store blocks so that they take effect. The legal basis is our legitimate interest in a safe service (Art. 6(1)(f) GDPR).

Subscriptions and payment. More storage is available with a subscription. The purchase is handled via the Apple App Store or Google Play. We do not see any payment details, only whether a subscription exists. To manage subscriptions we use a service provider based in the USA. Your account identifier, the purchase identifier and the subscription status are processed. Any transfer to the USA is based on the adequacy decision for the EU-US Data Privacy Framework or on EU standard contractual clauses.

Camera and photos. The app uses the camera for document scans, for photos taken directly in the vault and, if you switch it on, for the intruder photo taken with the front camera after several wrong PIN entries. Pictures taken do not end up in the photo library. Photos in the vault are backed up in the Cloud Vault like all vault content, as long as there is free space in your storage; photos from the chat camera only go to the chosen person; intruder photos remain exclusively on the device. The app only accesses your photos to import pictures into the vault, to delete originals from the photo library at your request, to save copies there or to send a photo you have selected in the chat. It only reads documents from other apps if you select them yourself. We only ask for permissions when you use the corresponding feature.

Notifications. If you allow notifications, we store your device's notification identifier (push token) from Apple or Google and the language of the app, as well as your settings (notifications for messages and friend requests, with or without names). A notification never contains the text or type of a message. The default is “New message”; on request, the other person's username is added. Only an identifier is included so that the app opens the right chat when tapped. Notifications are delivered via the Apple Push Notification service (Apple Inc.) or Firebase Cloud Messaging (Google). Our server communicates directly with these services; no other provider is involved. Please note that notifications may appear on the lock screen and on paired watches. We delete the identifier when you sign out or when it becomes invalid. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the device settings.

Feedback from the app. Under Settings › Help & contact you can send us a question, feedback or report a bug. For this we store your text, the type of feedback, your account's email address for the reply, app version, platform, language and time. The legal basis is the use of the app (Art. 6(1)(b) GDPR).

Microphone. The app only uses the microphone for voice messages in the chat and only while you yourself have started the recording. The first time, your device asks for permission. The app never records anything in the background.

6. Recipients and third countries

Data is only received by service providers we need for operation: the hosting provider (website and sending emails), the provider of the app's database and sign-in, Hetzner Online GmbH for file storage in Germany, the provider for managing subscriptions, and Apple and Google for distribution, billing and delivering notifications. We will name the providers for the database and subscriptions on request. We have agreements with processors pursuant to Art. 28 GDPR. We also pass data on to authorities if we are legally obliged to do so.

Some service providers have group companies in the USA. We base any transfer on an adequacy decision of the EU Commission (for companies certified under the EU-US Data Privacy Framework) or on EU standard contractual clauses (Art. 45, 46 GDPR). You can obtain a copy of the safeguards on request.

7. Retention period and deletion

We only store data for as long as the respective purpose requires. After that we delete it, unless there is a retention obligation. In detail:

• Trash: Deleted pictures stay in the trash for 30 days.
• Permanently deleted pictures: The picture disappears from the app immediately. For security reasons, the file in the Cloud Vault remains for a further 30 days and is then removed automatically.
• Deleting your account: You delete your account in the app under Settings › Account. You then have 30 days to cancel the deletion. After that, the account, entries and all files are permanently deleted. Backup copies are deleted no later than 30 days after that.
• One-time photos: see section 5.
• Chat messages and attachments: until you or the other person delete the account. We then remove them together with the account, including attachments you sent to others. Messages that you have only deleted for yourself also remain stored until then, because the other person can still see them. Once both people have deleted a message for themselves, we treat it like a message deleted for both sides and remove it 30 days after the second deletion. If you delete a message for both sides, we permanently remove text, attachment and one-time photo after 30 days. If a report on the conversation is open, we wait until it has been concluded. For groups, the paragraph “Group chats” in section 5 applies.
• Device list and notification identifier: until you sign out the device or delete your account. We delete a notification identifier that has become invalid immediately.
• Feedback from the app: until it has been dealt with, then for a maximum of 12 months.
• Friends and requests: until one of the two people removes the friendship, declines or withdraws the request, or deletes their account.
• Profile picture and status: until you change or remove them or delete your account. We delete a replaced or removed profile picture after 30 days, unless it is needed as evidence for an open report.
• Reports and blocks: We delete reports from the chat, together with the messages stored as evidence, and any entry about a block 12 months after the case has been concluded. If there are indications of criminal offences or ongoing proceedings, we store them for as long as necessary for that purpose.
• Access by the operators: If we view content in individual cases (see Summary), we log the time, the file and, where applicable, the reason. We delete these entries after 6 months.
• Invoices and subscription receipts: Statutory retention obligations (eight years for accounting records, six years for business letters, § 147 AO, § 257 HGB) remain unaffected. They run from the end of the respective calendar year.

8. Your rights

You have the following rights with respect to us, which you can exercise free of charge by writing to the email address in section 10:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), unless a statutory retention obligation prevents it
• Restriction of processing (Art. 18 GDPR)
• Data portability in a common format (Art. 20 GDPR)
• Objection to processing based on our legitimate interest (Art. 21 GDPR)
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR)

You can delete your account directly in the app. Instructions, including for the case without the app, are available at tresory.app/konto-loeschen. We usually answer requests within one month. To protect your data, we may ask for proof of identity.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de. You can also contact the authority at your place of residence.

9. Data security and changes

We protect your data with technical and organisational measures, including encrypted transmission, encryption of stored data, access restrictions, password protection and regular backups. In the event of a data breach that poses a risk to you, we will inform you and the supervisory authority within the statutory time limits (Art. 33, 34 GDPR).

We update this policy when the website, the app or the legal situation changes. The version published here applies. If there are significant changes in the app, we will inform you there.

10. Controller and contact

The controller responsible for data processing is Neumeister Media, owner Marc Neumeister, Döbelestraße 26, 78462 Konstanz, Germany. You can reach us by email at service@tresory.app and by phone at +49 157 35734617.

Please send all data protection requests to the email address above. We are currently not required to appoint a data protection officer.

Last updated: 17 October 2026