Click Lock — Privacy Policy

Effective date: September 17, 2026

Click Lock is a vault. You put photos, documents, passwords and API keys into it, and one password you choose locks them. Encryption happens on your device, there is no account and no server of ours, and your vault is never accessible to us — not because we promise not to look, but because there is nothing to look at and no key to look with.

1. Overview

This policy explains what information Click Lock handles, why, and the choices you have. Click Lock is developed by Krojač. By using the app you agree to this policy.

2. Data We Collect

We collect nothing. There is no account, no server of ours, and nothing is transmitted to us. The app stores the following on your device, encrypted:

The files and photos you add, together with their names, types, sizes and dates.
Password entries — title, user name, password, site and note.
API key entries — service, environment, value, expiry date and note.
Folder names, which exist only because items refer to them.
Thumbnails and website icons, encrypted exactly like everything else.

Only one file in the vault is readable without your password: a header holding the parameters needed to derive the key, the wrapped key itself, and an identifier for the vault. It contains nothing about you and nothing about what the vault holds.

3. Data We Do NOT Collect

No analytics, no usage tracking, no crash reporting services.
No advertising identifiers, no advertising of any kind.
No third-party SDKs. The app is built on Apple frameworks only.
No name, email address or phone number — the app never asks for one.
No location, at any time, for any reason.

The app writes a diagnostic log on your own device that records how long a step took and what the step was called. It never records a file name, a path inside the vault, an item count, or anything derived from the contents. It stays on the device and is never sent anywhere.

4. Your Password, and What It Means That We Cannot Reset It

Your password is not stored — not on the device, not in iCloud, not by us. What is stored is a key wrapped with a key derived from your password, and wrapping is not reversible without the password. This is what makes the vault a vault.

It also means that if you forget your password, the contents are gone. There is no reset link, no support request that can recover it, and no back door for anyone — including us and including any authority that might ask us. The recovery key, which the app issues once and you keep somewhere else, is the only second door, and you are the only person who has it.

5. Third-Party Services

iCloud Drive — if you turn it on, your vault syncs between your own devices through your own iCloud Drive container, under your Apple Account and not ours. What travels is already encrypted, with file names that are random identifiers. Apple stores those files and cannot read them. This is governed by Apple's Privacy Policy.
A website you name — when you tap to fetch the icon for a password entry, the app requests that site's icon from that site. It happens only on your tap, only for the address you typed, and nothing from your vault is sent with the request.
App Store — Click Lock Pro is sold by Apple. Apple handles the payment and tells the app only whether the purchase is active. We never see your payment details.

There are no other third parties.

6. Permissions the App May Ask For

Photo library — asked for when you first add pictures. It is used to read the pictures you pick and, only with the system's own confirmation, to remove their originals once the encrypted copy has been written and read back. Decline it and everything works except importing from the library; files can still come in through Files or Finder.
Face ID / Touch ID — optional, switched on by you. The vault key is then held in the device keychain behind biometric access control, this-device-only, and is never synchronised to iCloud Keychain. Adding a new face or fingerprint invalidates it, and the password is required again.

7. Data Storage & Security

Items are encrypted with AES-256-GCM. Each item has its own key, wrapped with the vault's master key, which is itself wrapped with a key derived from your password. Files are written so that only your user account can read them, and on iPhone so that they cannot be read at all while the device is locked.

Wrong password attempts are counted on the device: three pause the vault for an hour, five for a day. The count is kept on that device only and is never shared between your devices.

Because there is no account with us and no server of ours, there is no database of users to breach. On a Mac the app runs outside the sandbox so that you can drag files in from anywhere on the disk; another program run by you on the same Mac could therefore read the vault's files, and what it would get is ciphertext.

8. Your Rights & Choices

Delete any item from its own screen, or several at once in select mode.
Export a decrypted copy of anything, at any time. Once exported it is outside the app and this policy no longer governs it.
Turn iCloud sync off in Settings; the vault then stays on the one device.
Revoke the recovery key in Settings, which leaves the password as the only way in.
Deleting the app removes the vault stored on that device. Copies in your iCloud Drive container are removed with the container, from your Apple Account.

9. Children's Privacy

Click Lock is not directed at children under 13 and does not knowingly collect information from them. As stated above, it collects nothing from anyone.

10. Changes to This Policy

If this policy changes, the effective date above changes with it. Material changes will also be noted in the app's release notes.

11. Contact

If you have any questions about this Privacy Policy, please contact us at: questions@krojac.com.