Legal
Privacy Policy
1. Introduction & controller contact
Welcome to Secure Text (also displaying as “SecureText”), an iOS application developed and published by Bugra Acemoglu @ 2026 (“Developer,” “we,” “us,” or “our”).
Secure Text is an offline-first, client-only encryption toolkit designed to help users encrypt and decrypt text, files, and media locally on their devices before sharing the resulting ciphertext through third-party courier applications.
Because of the privacy-by-design architecture of Secure Text, we do not operate message servers, we do not require user accounts on our infrastructure, and we do not collect, intercept, or store your private cryptographic keys, One-Time Pad (OTP) files, or the contents of your messages.
- Developer / Legal Entity: Bugra Acemoglu @ 2026
- Contact Email: support.SecureTextApp@gmail.com
2. Privacy at a glance
- No messaging servers. We do not have servers that process, route, or store your messages, contacts, or encryption keys. Everything happens locally on your device.
- Local processing only. Message encryption (AES-256-GCM with hybrid ML-KEM-768 and P-256) and decryption occur entirely offline on your Apple device.
- No developer access. We cannot read your plaintext, view imported group keys, or access your pad files.
- No behavioral tracking. We do not use third-party analytics SDKs to track how you use the core features of the App.
- Monetization via Apple. Pro subscriptions are processed via Apple In-App Purchases and managed via RevenueCat, which only sees anonymous purchase identifiers and subscription status.
- Your responsibility. Because we do not store your data, you are solely responsible for backing up your identity keys and pad files.
3. What data is processed and where (on-device)
All of the following remains local on your device or within your own Apple iCloud storage if you choose to enable device backups.
| Category | Local storage |
|---|---|
| Contacts & identities | Public identity keys, optional display names and avatars. Stored locally in an AES-GCM encrypted database. |
| Private keys | P-256 identity private key in the Apple Secure Enclave where hardware permits, protected by biometry. |
| Group configurations | Encrypted local file protected by an AES-GCM store key in Keychain. |
| One-Time Pads | Local .tx.pad / .rx.pad files, protected at rest using ChaCha20 with Keychain-wrapped keys. |
| Temporary payloads | Staging files use iOS Data Protection and are cleared when the lifecycle ends. |
| App preferences | Lock settings, onboarding flags, and read-only widget snapshots via App Group. No message content. |
4. What we do not collect
The Developer does not collect, transmit, or store any of the following on developer-owned or controlled servers:
- Plaintext messages, notes, or media
- Ciphertext
- Contacts, QR codes, or public identity export files
- Private encryption keys, shared secrets, or group key files
- One-Time Pad files
- Precise GPS location
- Keyboard typing history or clipboard contents
5. Cryptographic processing
Cryptographic operations are performed locally using Apple’s CryptoKit, SwiftKyber (NIST FIPS 203 module for ML-KEM-768), and MultipeerConnectivity. Hybrid encryption combines classical ECDH (P-256) with post-quantum encapsulation (ML-KEM-768). Your classical private key is generated and secured within the Secure Enclave. Optional OTP exchange occurs over your local network only — it does not route through a cloud relay.
No system is mathematically unbreakable. Efficacy depends on device security, operational security, and the third-party couriers you use to transmit ciphertext.
6. App permissions
- Face ID / Touch ID: Unlock the App shell and authorize Secure Enclave operations. Biometric data never leaves your device.
- Camera: Scan QR codes for out-of-band public key exchange.
- Microphone: Record voice messages locally before encryption.
- Photo Library (Add Only): Save decrypted media after local decryption.
- Local Network & Bluetooth: Peer-to-peer OTP pad exchange.
- Custom Keyboard (Full Access): Required to share data with the containing app on-device. The keyboard does not log keystrokes or transmit what you type.
7. App extensions & App Group
Secure Text uses Apple’s App Group functionality so the main app, keyboard, share extension, and widget can communicate on your device. Widgets read local JSON snapshots. No decryption occurs in the widget, and no data is transmitted externally.
8. Subscriptions & third-party services
Monetization is handled exclusively via Apple In-App Purchases. RevenueCat receives an anonymous app user ID, purchase/entitlement state, and standard App Store IAP metadata. RevenueCat does not have access to messages, keys, contacts, or pads.
9. iCloud backups & device compromise
If iCloud Device Backup is enabled, encrypted local databases and pad files may be backed up to Apple’s servers. The Developer has no access to your Apple account or backups. If the device is jailbroken, malware-compromised, or physically accessed by someone who knows the device passcode, local encryption may be bypassed by the operating system.
10. Data retention & deletion
Delete the App to permanently remove App Group data, local files, and associated Keychain items. Clipboard copies from the main app are local-only and expire in approximately 15 seconds. An optional panic wipe destructively deletes keys, pads, and stores after consecutive failed passcodes.
11. International users & GDPR / CCPA
Because the Developer does not collect or store your personal data on remote servers, traditional data-subject requests for message data cannot be fulfilled — we do not possess that data. To exercise the right to erasure, delete the App from your device.
12. Children’s privacy
Secure Text is not directed at children under 16. If you are under 16, you may not use this App.
13. Changes
We may update this Privacy Policy from time to time. Material changes are reflected by updating the “Last updated” date, and may be presented in-app.
14. Contact
Questions about this Privacy Policy or the cryptographic implementation: support.SecureTextApp@gmail.com.