1. What ValetFS does

ValetFS is a vault that lives on your phone. You store secrets (API keys, tokens, credentials) in it, pair it with a ValetFS daemon running on a computer you control, and the daemon exposes those secrets as an in-memory filesystem only while your phone allows it. Closing the app starts a grace timer, after which the daemon unmounts and wipes its memory.

2. Information we collect

We collect nothing. The developer operates no user database for this app. There is no sign-up, no login, no email collection, no profile, and no behavioural analytics SDK embedded in the application.

3. Information stored on your device

• Secrets. The contents of your vault, and the list of the paths you have stored, are written to the iOS Keychain. Reading or sending a secret requires Face ID, Touch ID or your device passcode. If no biometric or passcode is enrolled, the app denies access rather than falling open.
• Pairing records. Session identifiers, the signaling URL and the daemon's public key are kept in app storage so the app can reconnect. Removing a pairing (“Forget”) deletes it.

Deleting the app removes all of this local data.

3a. Multi-device sync (optional, off until you choose)

ValetFS can keep your vault in your iCloud Keychain instead of only on one phone, so that opening the app on another device signed into the same Apple Account gives you the same vault. The app asks once and does nothing until you answer; you can change the choice at any time in Settings.

• What is synced. The secrets themselves and the index of their paths. Nothing else — pairing records stay on each device.
• Who can read it. iCloud Keychain is end-to-end encrypted with keys derived on your devices. Apple stores the items and cannot read them, and neither can we. This is Apple's service, governed by Apple's privacy policy; we receive nothing from it and have no visibility into it.
• Turning it off deletes the iCloud copies. The device you switch it off on keeps everything. But iCloud Keychain propagates that deletion to your other devices, and those devices hold only the iCloud copy — so ValetFS there will be empty. The app warns you before doing this.
• If you never switch it on, no secret and no path ever leaves your phone except end-to-end encrypted to a daemon you paired yourself.

4. Information transmitted, and to whom

4.1 Your secrets — end-to-end encrypted

Before any secret leaves your phone it is encrypted for the paired daemon only, using X25519 key agreement, HKDF-SHA256 key derivation and ChaCha20-Poly1305 authenticated encryption. The ciphertext is relayed by a Cloudflare Durable Object at valetfs-signaling.winm2m.workers.dev, operated by the developer on Cloudflare's infrastructure.

The relay holds no decryption key. It sees ciphertext, a random session identifier, and connection liveness — never your secrets, file names or contents.

4.2 Connection metadata

To route a session the relay necessarily processes a randomly generated session identifier, connection and disconnection times, and the network address your device connects from — the ordinary metadata of any internet connection. This is not linked to a name, email or account because none exists. It is discarded when the session ends; choosing “Forget” in the app deletes the session state on the relay immediately.

4.3 App updates

The app checks for over-the-air updates from Expo's update service (u.expo.dev, operated by 650 Industries, Inc.). Such a request conveys the standard information any HTTP request does — network address, platform, and the app and runtime version — together with a random installation identifier used to serve the correct update. It carries no vault data. See Expo's privacy policy.

5. Camera and biometrics

• Camera. Used for one purpose: decoding the daemon's pairing QR code. Decoding happens entirely on-device. No image is saved, and no image is transmitted anywhere.
• Face ID / Touch ID. Handled by iOS. The app receives only a yes-or-no result. Biometric data never leaves the Secure Enclave and is never accessible to the app or to us.

6. What we do not do

We do not sell, rent or share personal data. We do not serve advertising, we run no third-party advertising or analytics SDKs, and we do not track you across apps or websites.

7. Children

ValetFS is a developer tool and is not directed to children under 13. We do not knowingly collect information from children.

8. Your rights

Because we hold no personal data about you, there is no account to access, correct, export or delete. You retain full control locally: delete individual secrets in the app, use “Forget” to destroy a pairing and its relay state, or delete the app to erase everything it stored.

9. Changes to this policy

If this policy changes we will update the date at the top of this page and, where the change is material, note it in the app's release notes.

10. Contact

Youngjune Kwon — yjkwon@winm2m.com
Source code: github.com/WinM2M/valet-fs