Kelmori Privacy Policy

Kelmori requires no app identity account or email signup. There are no ads or analytics about your vault contents or vault activity. Android purchases use RevenueCat for purchase validation, entitlement management and revenue analytics, as described below. We hold no master decryption key, password-reset key or readable recovery phrase. Purchases use your Google Play or Microsoft Store account under that platform's policy.

The app encrypts vault contents, vault and file names, file indexes, folders, tags, favorites, notes and thumbnails on your device. You choose files through system selection, desktop drops or Android's share sheet and confirm the import. Originals remain in their original location. Camera and microphone access is used only when you choose capture; audio is optional.

Previews, camera capture, media optimization and intentional exports can use short-lived plaintext in private local temporary storage. Owned temporary files are cleaned after completion or on the next launch after an interruption. An individual-file export creates a readable copy at your selected destination. App memory, OS paging, device backups and storage hardware prevent guarantees of forensic erasure.

Encrypted vault data remains locally until removed or app data is deleted. Anonymous per-vault photo/video counts enforce free-plan limits locally. Encrypted vault counts, sizes, timestamps, quota records and the app's presence may remain observable to someone with filesystem access. Android automatic app backup and device-transfer backup are disabled by app configuration.

Try demo opens a separate local sandbox using generated sample content, separate vault keys, settings, backups and exports. It accepts generated samples rather than personal file imports. Pro capabilities in that sandbox require no purchase and do not grant Pro access to your personal vaults. Leaving or resetting the demo removes its sandbox data; interrupted demo sandboxes are cleaned on the next normal startup. Icons and shortcuts use previews by default. On Android, you can choose "Test on this device" to enable actual launcher icon changes and request pinned shortcuts without a purchase. The previous launcher icon is restored when you leave or reset the demo, or on the next normal startup after an interruption. Remove any pinned test shortcuts manually from your home screen.

Kelmori does not operate a vault server, hosted vault storage, automatic device synchronization or online sharing service. The app does not upload your vaults. You can export an encrypted backup file, move it by USB or another method you choose, and import it on a compatible Windows or Android installation. The receiving installation needs the correct secret. Keep tested backups and matching recovery phrases separately. Android billing uses the external RevenueCat and Google Play services described below.

Saving a backup or exported file into a cloud-connected folder, importing from a cloud file provider, or transferring through another app involves that provider under its own policy. Kelmori does not control those external copies, destinations or providers.

Store services process payments, purchase history, subscription status and store-account information. Kelmori queries product offers and entitlements but does not receive full payment-card details. Windows purchases use Microsoft Store billing. Purchases are platform-specific; there is no shared Windows/Android identity account. Encryption, recovery, individual exports and encrypted backup export/import remain available without Pro.

On Android, RevenueCat receives a randomly generated anonymous app customer ID, purchase receipts or tokens, purchase history, subscription and entitlement status, and required app/device metadata. This data supports purchase validation, entitlement functionality and revenue analytics. Purchase history collection is required by the billing integration and is retained beyond a single request; it is not ephemeral. Data is encrypted in transit. Kelmori does not configure customer attributes, email, names or advertising identifiers, and disables optional RevenueCat diagnostics and device identifier collection. No vault files, vault or file names, notes, passphrases, keys or recovery words are sent to RevenueCat. No other RevenueCat integrations or hosted paywalls are used.

On Android, the Google Play Billing library also sends billing-service diagnostics to Google, including API results, connection information, app and device software details, and a randomly generated billing-client session identifier. This automatic billing diagnostics collection supports billing operation and performance analysis; it does not contain your vault files, names, passphrases or recovery phrases. Google handles its store and billing data under its own privacy policy. TreeByte Software does not operate its own server receiving these Google billing diagnostics.

Deleting local app data or vaults does not delete purchase records held by a store or RevenueCat. For billing-data privacy or deletion requests, contact contact@treebytesoftware.com; do not send vault files, passwords or recovery phrases. Cancel subscriptions through the store where you purchased them. A billing-data deletion request does not itself cancel a subscription.

Removing an item commits the encrypted index and attempts to reclaim its encrypted blobs. Earlier backups, originals and exported copies remain separate. The optional Pro duress setting removes other local vaults on that installation. It does not erase other devices, external backups, manually copied files or physical storage remnants. An explicitly acknowledged phrase-authenticated restore can recover one selected encrypted backup while retaining duress isolation.

Uninstalling or deleting local app data can permanently destroy access. Recovery requires the matching local vault or encrypted backup and its correct secret. There is no developer recovery or password-reset service. Keep a tested encrypted backup and recovery phrase separately. Generated recovery words are recommended; custom phrase length alone does not guarantee strength.

Kelmori uses authenticated encryption and locks on background/focus loss and inactivity, with temporary exceptions for native system prompts. Encryption does not protect a vault already open on a compromised device or a secret captured by malware or another person. The app provides no guarantee of forensic invisibility or physical secure erasure.

Policy changes will appear here with a revised date. For privacy questions contact contact@treebytesoftware.com.