Horology Vault Privacy Policy

Last updated: 11 November 2026

This policy explains what Horology Vault does with information about you. In short, your collection stays on your iPhone and in your own backups (section 4.4). A few things leave your iPhone only when you send them yourself, and, apart from Apple's own services (section 4.6), one kind of small request happens on its own once you allow it: a download of public exchange rates, repeated whenever the app's rates are missing or more than 12 hours old (section 4.3). All of them are listed here.

This website

This website is hosted on Google Cloud Run in its us-central1 region in the United States. Google processes technical request information, which can include your IP address, the requested page, request time and browser details, to deliver the website and support its security and operation. Google Cloud may retain these technical logs under the hosting account’s logging settings and its applicable service terms. We have not yet completed a review of the configured retention period.

This hosting information is separate from the app data described below. Browsing this website does not give us access to your watch collection.

1. Who we are

Horology Vault is made by EndKai: Endkai SA, c/o Kellerhals Carrard Genève SNC, c/o Kellerhals Carrard Genève SNC Rue François-BELLOT 6, 1206 Genève, Switzerland, CHE426322163 ("we", "us"). We are responsible for the information described in this policy.

• Privacy questions: contact@horologyvault.app
• Support: contact@horologyvault.app

2. The short version

• There's no account in the app, and no advertising, analytics tools or tracking. We don't sell personal data, or share it with advertisers or data brokers.
• Your watches, photos, prices, papers and notes are stored on your iPhone. We never receive them unless you send them to us yourself.
• What you add is read on your iPhone: details you type or say, papers you scan, photos and files you import. Nothing is uploaded to read them.
• Watch Expert answers on your iPhone, with the app's own rules or Apple's on-device model. It's private by default: a cloud AI provider gets something only if you choose one, add your own key and agree to what it would send, like sharing a PDF report with a friend (section 4.2).
• We receive something from you only when you send it, such as an email to support, or when Apple shares it with us: crash reports and performance data if you share analytics with app developers, your App Store review, and, if you test with TestFlight, your tester details, how you use the test version (such as installs and sessions), your feedback and crash reports (section 4.6). We also keep the name and email address of the collectors we ask to test the app, with what they tell us for the invitation, whether or not they join (section 4.6), and of the writers and people we know whom we tell about its release (section 7).
• Apart from Apple's own services (section 4.6), the only requests the app makes on its own are downloads of public exchange rates, made only once you allow them and then whenever its rates are missing or more than 12 hours old (section 4.3).

3. What stays on your iPhone

• Your vault. Your watches, references, serial numbers, prices and values, insurance, papers and scans, wear and service history and notes are kept in the app's private storage on your iPhone. The database and your watch photos use iOS's complete file protection, which means they can be read only while your iPhone is unlocked. We have no copy, unless you send us one yourself (sections 4.1, 4.5 and 4.6).
• Photos. You take photos with the camera, choose them in Apple's photo picker or in Files, or open them in the app from Files or Mail. A shortcut can also give the app a photo for Search Collection by Image (Photo Search, in Settings › System Integrations), which compares it with your collection on your iPhone and doesn't keep it. The app asks only for permission to add images to Photos, when you save one there, such as a watch card or a Watch Expert answer image; it never asks to read your photo library.
• Camera, microphone and speech. Watch recognition and the reading of scanned papers run on your iPhone. Speech is turned into text on your iPhone. The app doesn't use your location.
• Face ID and Touch ID. iOS checks your face, fingerprint or passcode; the app only learns whether unlocking succeeded.
• Watch Expert answers questions about your collection on your iPhone. The app works out the answers it can with its own rules, on any iPhone, and Apple's on-device model, which needs an iPhone with Apple Intelligence, answers the others. Unless you choose a cloud AI provider and agree to what it would send (section 4.2), it sends nothing you ask it anywhere. If you pin an answer to Analytics, the app keeps your question with your vault, so it is also in your backups (section 4.4).
• Widgets, Siri, Shortcuts, Spotlight and notifications.
  • In Settings › System Integrations you choose how much widgets, Siri, Shortcuts and Spotlight may show. By default the level is Privacy First, which shows no watch names, values or photos.
  • Siri and Spotlight use your watch names only while Let Siri and Search Use Watch Names is on, under Siri & Shortcuts in the same screen. At Privacy First that switch stays off until you turn it on, so until then Spotlight shows none of your watches and Siri can't list or name them; at Balanced and Detailed it is on unless you turn it off. If you turn it on at Privacy First, Siri and Spotlight know each watch by its brand and model, never its reference, a value or a photo. At every level, Siri also knows a watch by a nickname the app's watch catalog gives its model or reference, such as Moonwatch, when it has one, and by the Spoken Name and Also Called names you give it in Add Watch or Edit Watch.
  • If you let Siri use your watch names, the app gives those names to iOS on your iPhone, so that Siri can understand them, with a watch's Spoken Name first when it has one. For the watches it suggests to Siri, at most 40, it also gives iOS each one's photo while Show Watch Images is on and, at Detailed, when you last wore it or that its service is due. Apple's documentation for App Shortcuts says that Apple "may extract anonymized App Shortcuts data such as localized phrases, display representation values", as well as the titles and descriptions of related intents, and that machine-learning models are trained with this data. The names, photos and details the app gives iOS this way can be among those values.
  • When you log a wear in the app while that switch is on, the app also tells iOS on your iPhone which watch you wore, so that Siri can suggest logging it again. It names the watch by its brand and model, with its variant and reference only at Detailed or with Show Variant & Reference on, and never with a value, a photo, a serial number or a note. The app asks iOS to remove these suggestions when you turn the switch off or change a setting there so that it shows less, and when you restore a backup; for one watch, when you delete it or whenever its brand, model, variant, reference or status changes; and Undo removes the one for the wear you just logged.
  • When you speak to Siri, Apple handles your request under its own privacy policy.
  • The app's actions in the Shortcuts app follow the same switch and level. With the switch on, an action such as Search Watches, Get Most Valuable Watch or Get Collection Value gives its answer to the shortcut that runs it: a watch's brand and model; its variant and reference at Detailed or with Show Variant & Reference on; at Detailed also its dial, case, condition, collection, last wear, and coverage and service status; and, with Show Values on, its value or your collection's total. With the switch on, Get Vault Status, Collection DNA Brief and Wanted Watch Follow-Ups answer with a summary instead, the same at every level: how many of your service reminders need attention, or how many of your watches have coverage details to review, no documents attached or no wear logged in the last 30 days; how many watches you have, with a short summary of your collection's style; and how many wanted-watch follow-ups are due. A shortcut you build can pass that answer to other apps; Horology Vault itself sends it nowhere.
  • Widgets read a copy kept in a shared area of your iPhone. iOS protects that copy until you first unlock your iPhone after a restart; after that, widgets can read it while your iPhone is locked. At a more detailed level that copy can include watch names and references and the names of your collections, and values and photos only if you turn them on.
  • Reminders are scheduled on your iPhone. Settings › Notifications › Private Notification Text hides watch names in alerts.
• A technical event log. The app keeps a small log of recent events, such as which screen opened or which step failed, to help fix problems. It holds event names and codes, never what you typed. It is left out of your iPhone's backups. The names of up to 50 of its recent events, with how many seconds before the problem each one happened, leave your iPhone only in the report you send with Report by Email (section 4.1).
• Problem records. When iOS reports a crash, a freeze or another problem, the app keeps its technical record on your iPhone for 30 days, for Settings › Recent Problems. It is left out of your iPhone's backups, and it leaves your iPhone only if you send it with Report by Email (section 4.1).

If you delete the app, iOS deletes its data from your iPhone, with two exceptions:

• Items in your iPhone's Keychain can stay after the app is deleted. Horology Vault keeps three items there, on this iPhone only: your backup recovery key, a key that protects data the app can rebuild, and a random code that tells your backups which iPhone wrote them. It also keeps there, on this iPhone only, any API key you add for an AI provider (section 4.2). None of them holds your collection. To remove an API key, delete it in Settings › AI Services before you delete the app.
• Copies in your backups stay until you delete those backups (section 4.4).

4. What leaves your iPhone, and when

Every connection the app opens itself, and every hand-off to Mail, the share sheet or a web search in your browser, is listed in the app's code, and a test checks the code against that list. The encrypted iCloud Drive backup (section 4.4) and the install check (section 4.6) go through iOS and Apple's services instead, and the links of section 4.8 carry nothing from your vault. These are all of them.

4.1 Email to support

Some buttons open your own email app with a prepared support message. Use contact@horologyvault.app as the recipient; if your test build fills in a different address, change it before sending. You can read and change the message, and you send it yourself; the app opens no connection of its own.

• Email Support, the first row in Settings (and in Settings › Help & Support), fills in the app's version and build, your iPhone model and iOS version, and nothing from your vault.
• Email Support on a message about a problem fills in the same details. On most such messages it also adds the problem's technical details: its code, the kind of error and its number when there is one, the screen and the function where it happened, and an 8-character support code. Of the error itself, only its kind and number are added, never its message. The screen and the function are named as they are in the app's code, such as WatchDetailView, never by the title a screen shows, which can name one of your watches. The support code is made at random for that one problem: nothing about your iPhone or about you goes into it, and the next problem gets a new one. Nothing from your vault is added.
• A recovery request (Email Recovery Request, which the app offers when a vault can't be opened or its update stopped) adds the app's version and build, your iOS version and a technical failure code. When the app has opened a recovery case for a vault it couldn't open, it also adds the case number and where the recovery stands. It says that no vault contents are attached.
• Report by Email, on the card Home shows after the app closed unexpectedly, on the screen the app shows if it keeps closing as it opens, and next to each problem in Settings › Recent Problems, which lists the crashes and slowdowns recorded on your iPhone in the last 30 days, prepares an email to support with a report attached. Before anything goes, a screen shows you the attached file: its name, its size and its exact text. Then the email opens in Mail inside the app, addressed to support, with the file attached and the same details as Email Support; if Mail isn't set up, you can share the file another way and copy our address. The file holds a random code for the report, which is also in the email's subject, and the time the report was made. It names the app's version and build, whether it's a test version or the App Store version, your iPhone model and iOS version, and a code for the kind of problem and when it happened. It lists the names of up to 50 recent events in the app's log, with how many seconds before the problem each one happened. For a crash, a freeze or another problem that iOS recorded, it holds that problem's technical record: the codes iOS gave, how long a freeze, a slow start or heavy processor use lasted, or how much it wrote, where in the code it happened, as numbers, and which tab and step the app was on. It never includes your watches, references, prices, serial numbers, notes or photos, your device's name or any identifier of your device.
• What we receive: your email address and the name your email app sends with it, your message and anything you attach.
• Where it's stored: support mail is stored by Proton AG (Proton Mail), with servers in Switzerland, Germany or Norway. When your email reports a problem, we also keep on our computer a copy of your message, with email addresses removed, and of what you attached, to fix the problem; a file our tools can't read, or an email they can't file, is kept as it came, email addresses included (section 6).
• How we use it: only to answer you, to fix problems, to consider the ideas you send for future versions and, for a catalog suggestion (section 4.5), to consider it for the app's catalog. Our separate planning list keeps anonymous ideas or themes without the sender's identity. Only we read your messages; no AI tool reads them. When your email carries the app's report (Report by Email), the AI coding tools we use to fix the app read that report's technical details: the app's version and build, your iPhone model, when the problem happened, its codes and where in the code it happened, never your message, the other files you attach, your name or your email address (section 5). For each email that reports a problem, they also read the short note we write for them about it, in our own words, without your name or your address and without quoting you.

4.2 AI providers you choose

Horology Vault is private by default: Watch Expert answers on your iPhone (section 3). In Settings › AI Services you can also choose a cloud AI provider, OpenAI's ChatGPT, Google's Gemini, Anthropic's Claude or xAI's Grok, and add your own API key for it. If you do, you decide what it gets, the way you decide what goes into a PDF report you share with a friend:

• Nothing leaves unless you've agreed. Before a request goes to the provider, unless a permission you kept covers it, the app shows you what it would send: your question, and the watch or collection details it needs. You choose Allow Once, Always Allow or Don't Allow. Until a request is allowed, the app sends nothing. Always Allow covers that kind of detail for that provider until you revoke it in Settings › Privacy & Security › What Leaves This iPhone, or change the provider or its key. Prices, values, photos and documents are asked about for each request, and prices and values can go only while you've unlocked financial details in the app.
• Understanding your questions. In Who understands your questions you can let the provider read the words of a question the app can't work out on your iPhone; nothing from your collection goes with them, and the answer is worked out on your iPhone. It's off until you choose it.
• Requests go straight to the provider, from your iPhone to its servers (api.openai.com, generativelanguage.googleapis.com, api.anthropic.com or api.x.ai), with your key. They don't pass through us, and we can't see them.
• Checking your key. When you add a key, check a connection, or open or refresh a provider's model list, the app asks the provider to confirm the key or to list its models. Nothing from your vault goes with it.
• The provider handles what it receives under your agreement with it and its own privacy policy. Providers may keep requests for a time, for example to detect abuse, and, depending on your plan and settings, some may use them to improve their services. Some require you to be 18 or over. Please read their terms before you connect one.
• Removing a key in Settings › AI Services deletes it from your iPhone. To cancel the key itself, use the provider's website.

4.3 Exchange rates

To convert between currencies, the app downloads public exchange rates from fxratesapi.com. If that fails, it uses the European Central Bank's daily feed (ecb.europa.eu).

• Only once you allow it. Until you do, automatic downloads are off: the app keeps the rates it already has and requests nothing.
  • When a screen needs to convert an amount and the app has no rates, or only rates more than 12 hours old, the app asks "Download Exchange Rates?", until you answer. It says that it downloads public rates from FXRatesAPI, or the European Central Bank if that fails, and that nothing from your vault is sent.
  • Download turns automatic downloads on and brings the rates up to date at once; Not Now leaves them off. If you pick a new display currency in Settings › General while they are off, the app asks again.
  • Update Rates Automatically, in Settings › General, shows your answer, and you can change it there at any time.
• When:
  • with automatic downloads on: each time you return to the app, when you open Settings › General, when you turn on Update Rates Automatically and when you pick a new display currency there, if it has no rates yet or its rates are more than 12 hours old;
  • whatever you chose: at once when you tap Refresh Exchange Rates in Settings › General.
• What's sent: nothing about you or your collection. Like any internet request, the request shows your IP address to that service, with the standard technical details any app's internet request carries, such as the app's name and build and the system version.

4.4 Backups

• Encrypted iCloud Drive backup (off until you turn it on). You turn it on in Settings › Backup & Sync, with a recovery key that you confirm or already have. The app encrypts the backup on your iPhone with that key before it goes to iCloud, so we can't read it. It's stored in the app's own folder in your iCloud Drive, under Apple's iCloud terms. Once it's on, Back Up Now makes a backup at once. Under Automatic Backup, which starts at Off, you can choose Daily, Weekly or Monthly; the app then makes a new one on that schedule, in the background when iOS allows or while the app is open. Turning the backup off stops new backups and keeps the ones already made. To delete them, in your iPhone's Settings tap your name, then iCloud, and delete Horology Vault's data from your iCloud storage.
• iPhone backups. Like most apps, Horology Vault's data is included in iCloud or computer backups of your iPhone, under your iPhone's settings and Apple's terms. We can't read them.

4.5 Catalog suggestions

In Settings › Data & Sharing › Suggestions to Horology Vault you can review a suggestion for the app's watch catalog and send it to us from your own email app. The email holds the catalog details you reviewed: the brand, model or catalog option (such as a case material or a complication) as you entered it for one of your watches, with a model's brand, and a brand's country and founding year when you gave them. As the review lists under Technical Metadata, it also holds the app's language and region, the catalog's version and a duplicate-prevention key made from the suggestion itself; part of that key is also in the email's subject. Nothing else from your vault is added: no watch ID, serial number, value, location, note, photo or document. We receive your email address and the name your email app sends with it, and section 4.1 applies.

4.6 Apple, and testing with TestFlight

• Install check. The app asks the App Store, through Apple's StoreKit, whether it was installed from the App Store or as a test version.
• Crash reports. If you've chosen in iOS Settings to share analytics with app developers, Apple may share crash reports and performance data about Horology Vault with us. We download them from Apple to our own computer and use them only to fix problems; the AI coding tools we use to fix the app read them there (section 5).
• Ratings and reviews. If you rate or review Horology Vault on the App Store, Apple shows us your review in App Store Connect. Our computer downloads its title, text, star rating, country and date, to help us find and fix problems. Before anything is kept, your nickname is replaced with a code and, if it is three characters or longer, removed from the text, and so are email addresses and @handles. To fix a problem a review describes, the AI coding tools we use to fix the app may read what we keep of it (section 5). We may also reply to your review in App Store Connect: Apple shows our reply under your review on the App Store and tells you about it.
• Invitations to test. If we asked you to test Horology Vault, we keep your name and email address, and what you told us for the invitation (such as the size of your collection, how you keep its records and your iPhone model), in our own notes and in the mailbox we invite you from (section 5), whether or not you joined. If you said yes, we give your name and email address to Apple to invite you.
• If you test with TestFlight:
  • Apple shares with us your tester name and email address, any feedback and screenshots you send, crash reports, device details such as model, iOS version, language and time zone, and how you use the test version (for example installs and sessions).
  • We copy your feedback, screenshots, crash reports and device details to our computer to fix problems, never your name or how you use the test version. There, your email address is replaced with a code, and the address itself isn't kept. The AI coding tools we use to fix the app read the crash reports and the device details of your feedback there, never your name, your email address, your comments or your screenshots (section 5).
• iCloud, Siri and Apple Intelligence are Apple's services, under Apple's own terms and privacy policy.

4.7 Things you share yourself

• Exports leave your iPhone only through the share sheet, where you choose where they go. They include watch packages, watch cards, PDFs, claim packets (Tools › Claim Packet), collection files (CSV or JSON, from Tools › Export Collection) and Watch Expert answers you share.
• A watch card shows the watch's photo, if it has one, with its brand, model, reference and year. It has no serial number or value field, but a photo can show a serial number, so check the photo before you share it.
• A watch package (Settings › Data & Sharing › Create Watch Package; Create Transfer Package in a watch's Share & Export menu; or, after Select Watches in the Vault tab, Export Private Package or Share Redacted Package under More) can carry your whole vault. Protect a Private Package with a password, and the app encrypts its contents with that password before you share it; its creator label (Horology Vault unless you change it), the number of watches and of photos and other files it holds, its size and the date stay readable to anyone who has the file. Without a password, a Private Package isn't encrypted. A Presentation Package, a redacted overview, has no password.
• A collection file isn't encrypted. Redacted, the default, leaves out serial numbers, values and purchase details; Private, which first asks for Face ID, Touch ID or your passcode when your iPhone has a passcode, adds serial numbers, purchase prices and their currencies and, in JSON, purchase dates.
• A PDF report, also from Tools › Export Collection (PDF Reports: Insurance Documentation, Collection Showcase, Detailed Inventory or Collection Report), isn't encrypted either. Redacted, the default, prints your watches' names, references and specifications, with the photos and the service dates and types you include; Private, which first asks for Face ID, Touch ID or your passcode when your iPhone has a passcode, can add serial numbers and service providers and, in Insurance Documentation and Collection Report, recorded values, whether each watch is insured and for how much, your insurer and policy number, and purchase prices and dates. Photos print as you added them, so check them before you share a report.
• A claim packet isn't encrypted either. Tools › Claim Packet makes one for the watches you choose, after Face ID, Touch ID or your passcode when your iPhone has a passcode: a PDF and a JSON file with the details you include, such as serial numbers, values and insured values, your insurer and policy number, purchase details, documents, service receipts, photos and private notes, and the claim details you type in. The app keeps the newest packet of each kind for each set of watches on your iPhone, under Recent Packets, where you can delete any of them (section 6).
• Get a Template, where the app offers it, shares a blank import template with two made-up example watches; it holds nothing from your vault.

4.8 Links and web searches

• Links to this policy, to Apple's terms and to Apple's pages about Apple Intelligence open in your browser, and so does the site button under From the Web in Paste Specs, which opens the page you copied the specs from, at its address without any query or sign-in; those sites' own policies apply.
• Search the Web, offered where the app's catalog doesn't know a watch and in Search Online on Add Watches, opens your browser with a search for only the words its button shows. They come from the brand, model and reference in Add Watch, which you typed or said, or which the app filled in, for example from your papers, and which you can change; or from the words you searched for. The app never adds a serial number, note or price. The app opens no connection of its own: your browser runs the search, on DuckDuckGo, under that service's own policy.

5. Who processes data for us, and where

Each provider in this table other than Apple processes data only for us, under terms that protect it at least as well as this policy. The AI providers you choose (section 4.2) aren't our processors: you choose them, you add your own key, and they handle your requests under your agreement with them.

fxratesapi.com and the European Central Bank aren't our processors. The app asks them for public rates directly, and they receive nothing about you beyond what any internet request shows (section 4.3).

When data goes to a country that Switzerland, the EU or the United Kingdom doesn't consider to protect it adequately, we rely on safeguards: the EU Standard Contractual Clauses, with the changes Swiss or UK law requires, or the Swiss-US or EU-US Data Privacy Framework, with its UK extension, where the provider is certified. You can ask us for a copy of these safeguards.

6. How long we keep it

7. Why we're allowed to use it

The Swiss Federal Act on Data Protection (FADP) applies to us. The EU General Data Protection Regulation (GDPR) also applies when you're in the EU or EEA, and the UK GDPR when you're in the United Kingdom.

• Support emails, and anything you attach to them: our legitimate interest in answering you, fixing and improving the app, and improving its catalog (GDPR Art. 6(1)(f)). You choose each time what you send.
• TestFlight feedback and crash reports from Apple: our legitimate interest in fixing the app (Art. 6(1)(f)).
• App Store reviews that Apple shows us: our legitimate interest in finding and fixing problems, and in replying to you on the App Store (Art. 6(1)(f)).
• Inviting you to test: our legitimate interest in testing the app with collectors before its release (Art. 6(1)(f)).
• Telling writers and people we know about the release: when Horology Vault comes out, we email the news once, from our own mailbox, to writers who cover watches, iPhone apps or local news and to people we know, and for this we keep their name, email address and, for a writer, their publication (sections 5 and 6): our legitimate interest in announcing the app (Art. 6(1)(f)).
• Requests about your data: to meet our legal obligations (Art. 6(1)(c)).

You don't have to send us anything. If you don't, the app works the same.

8. Your rights

You have the right to:

• access your data;
• have it corrected or deleted;
• restrict or object to its use;
• receive it in a portable format;
• complain to a supervisory authority:
  • in Switzerland: the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch);
  • in the EU or EEA: the authority where you live or work;
  • in the United Kingdom: the Information Commissioner's Office (ico.org.uk).

How to use them. Write to contact@horologyvault.app. We answer within 30 days.

What we hold. We hold only what you or Apple sent us, our notes for inviting you to test and about the problems your emails report, our list for telling writers and people we know about the release, and a record of any request you make about your data: support emails, the details of your invitation, your name and email address, with a writer's publication, if we told you about the release (section 7), and, from Apple, crash data, your TestFlight details (name, email address, device details, installs and sessions) and feedback, and App Store reviews (sections 4.1 and 4.3 to 4.6). Your vault on your iPhone and your encrypted iCloud Drive backup are yours alone: we can't see them, and you can delete them yourself (sections 3 and 4.4). We never receive what you send to an AI provider you chose: for those requests, contact that provider (section 4.2).

9. Security

• Your vault's database and photos use iOS's complete file protection.
• Your backup recovery key stays in your iPhone's Keychain, on this iPhone only.
• Our computer's disk is encrypted.
• The support mailbox, and the mailbox we invite testers from, use two-factor sign-in.

10. Children

Horology Vault is meant for adults and isn't directed at children. If you think a child has sent us information, write to us and we'll delete it.

11. Changes to this policy

When we change this policy, we update the date at the top. Before a significant change takes effect, for example a new kind of data leaving your iPhone, we say so in the notes of the app update that brings it. Earlier versions are available on request.

12. Contact

EndKai: Endkai SA, c/o Kellerhals Carrard Genève SNC, c/o Kellerhals Carrard Genève SNC Rue François-BELLOT 6, 1206 Genève, Switzerland, CHE426322163. contact@horologyvault.app.