Privacy policy

01Who is responsible

The data controller is the company that develops and publishes the app:

Controller: FIRST LAYER S.R.L.
Registered office: Via della Giunchiglia 71, 06131 Perugia (PG), Italia
VAT and tax code: 03994330540
REA: PG - 370965
Email: team@firstlayersrl.com
PEC: firstlayer@pec.it

For any privacy question, or to exercise your rights, write to team@firstlayersrl.com or to our certified email (PEC).

02How the app is built

Data protection isn’t a rule we follow. It’s how the app works (Article 25 GDPR, data protection by design and by default).

On-device encryption. Photos and videos are encrypted on your phone with 256-bit encryption, using a key unlocked by the sign you draw (strengthened with Argon2id and bound to the phone’s secure chip). The sign isn’t stored: the key is recomputed on the device each time you unlock.
No account, no server. We don’t ask for your name, email or phone number. We have no server your content could reach.
Only your sign. The app opens with your sign or your recovery phrase. It doesn’t use Face ID or Touch ID.
No cloud backup. sigil. doesn’t copy your vaults to iCloud or any other service, and vault files are excluded from device backups.

That’s why we are not the controller of the content you keep in the app: we never receive it and have no way to access it.

03What we don’t collect

Neither we nor anyone on our behalf collects:

photos, videos, documents, album or vault names, thumbnails or file metadata;
your sign, your encryption keys, your recovery phrase;
how many vaults you have, or whether you use hidden vaults, the decoy vault or self-destruct;
your name, email, phone number, contacts or location;
advertising identifiers (IDFA): we don’t track you, show ads, or include advertising SDKs.

The app sends no usage statistics, to us or to anyone else.

The app asks for access to Photos, Camera, Microphone and Local Network only when you use the feature that needs it. These permissions are used on your phone; nothing the app reads through them is sent to us.

04What we process, why, and on what basis

Support emails

If you write to us, we process your email address, your name if you give it, and your message, only to reply. Legal basis: performance of a contract when the request concerns the app or a purchase (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering people who contact us (Art. 6(1)(f)). Please don’t send us photos, your sign or your recovery phrase: we will never ask for them.

Purchases

In-app purchases are sold and processed by Apple, which handles your payment data as an independent controller under its own privacy policy. From Apple we receive only aggregated sales and usage reports (such as country, product, price and date), never your name or email. Checking whether you have Pro happens between your phone and Apple. Legal basis: performance of a contract (Art. 6(1)(b)) and accounting and tax obligations (Art. 6(1)(c)).

Crash reports

If you chose in iOS to share analytics with app developers, Apple may forward us technical crash reports for the app. We use them only to fix bugs. You can turn this off in Settings › Privacy & Security › Analytics & Improvements.

05This website

No cookies, no analytics, no third-party trackers or embeds. Fonts are served from our own domain.
Hosting and server logs. The site is hosted by Vercel Inc., a hosting provider acting as our processor. To serve the pages and protect the site from abuse, it records technical request logs: IP address, date and time, requested page, referrer and user agent. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f)). Logs are kept for the short period set by the provider.
App Store links. Download buttons go through a short redirect that adds a campaign code naming the page and the button (for example “pricing_header”). It contains nothing about you, sets no cookie and isn’t logged by us; it only lets us see, in Apple’s aggregated reports, which page leads to downloads.
Free tools. The EXIF remover, metadata viewer and strength meters run entirely in your browser. Files and passwords are never uploaded.

06Who receives data

We don’t sell data or share it for advertising. Only these may receive it:

Apple (Apple Distribution International Ltd. and its affiliates), independent controller for sales, payments and technical reports;
Vercel Inc. (United States), our processor for website hosting;
Google Ireland Limited (Google Workspace), our processor for the support mailbox;
advisers bound by confidentiality (such as accountants and lawyers), and public authorities where the law requires it.

If an authority asks us for your data, we respond as the law requires. But we have no content, keys or account to hand over: at most the emails you sent us.

07Transfers outside the EU

Some providers (notably Vercel Inc. and Apple) are based or have servers outside the European Economic Area. When data leaves the EEA, the transfer relies on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified companies, or on the Commission’s standard contractual clauses (Art. 46 GDPR). You can ask for a copy of the safeguards at team@firstlayersrl.com.

08How long we keep data

Support emails: as long as needed to reply, then at most 24 months after the conversation ends, unless we need them longer to defend a legal claim.
Apple reports: for the period required by law for accounting records (10 years under Italian law).
Website logs: for the short period set by the hosting provider.
Your content in the app: stays on your phone until you delete it, self-destruct is triggered, or you delete the app. We never had it.

09Your rights

You have the right to:

access your data (Art. 15) and have it corrected (Art. 16);
have it erased (Art. 17) or its processing restricted (Art. 18);
data portability (Art. 20);
object to processing based on legitimate interest (Art. 21);
not be subject to decisions based solely on automated processing (Art. 22): we make none.

Write to team@firstlayersrl.com or to our PEC address: we reply within one month (Art. 12). Because we have no accounts and the app sends us no data, we often hold no data we can link to you (Art. 11); if so, we’ll tell you. Only you can delete the content of your vaults, from the app.

If you believe we process your data unlawfully, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, garanteprivacy.it), or with the authority of the EU country where you live or work.

10Security

We keep what we process to a minimum and encrypt what matters on your device. No system is perfect, though: the limits of sigil. are explained in our Terms. If you find a vulnerability, write to team@firstlayersrl.com.

11Children

sigil. is not aimed at children under 14 and we don’t market it to minors. We don’t knowingly collect data from children under 14. If you’re a parent and think your child has written to us, contact us and we’ll delete the data.

12Changes

If we change this policy, we update the date and version at the top of this page; for significant changes we also say so on the website and, where relevant, in the app. We will never start collecting new data from the app without asking you first.