FQ Forgotten Quarry Privacy policy for Cypher Stash

Privacy Policy

Cypher Stash Privacy Policy

Effective Date: August 6, 2026

Introduction

Cypher Stash is operated by Forgotten Quarry LLC ("Forgotten Quarry," "we," "our," or "us").

This Privacy Policy explains how information is handled when you use the Cypher Stash mobile application ("Cypher Stash" or the "App").

1. Privacy-First Design

Cypher Stash is designed to keep your private vault content on your device. Forgotten Quarry does not operate a cloud-storage service for your vault and does not require a Cypher Stash cloud account.

Your vault files and other private content remain under your control unless you deliberately export, share, or back them up using a service or location you select.

Cypher Stash normally uses limited pseudonymous operational diagnostics to identify crashes, correct software defects, and maintain application reliability. Where applicable platform rules or law require prior permission, diagnostic collection begins only after you authorize it. On iOS, Firebase Analytics and subscription-conversion measurement remain a separate privacy choice. Android subscription attribution is supplied directly by Google Play rather than by a custom in-app Firebase conversion event.

2. Private Information We Do Not Transmit

Cypher Stash does not transmit the following information to Forgotten Quarry, Google Firebase, Google Ads, or another analytics provider:

  • Photos, videos, documents, or other files stored in a vault;
  • Passwords, password hashes, authentication credentials, or security-question answers;
  • Local Cypher Stash usernames or vault identities;
  • Filenames, folder names, vault names, or private notes;
  • Keystrokes, text entered into the App, or clipboard contents;
  • Private-browser history, visited URLs, search terms, or page contents;
  • Biometric templates, fingerprints, or facial-recognition data; or
  • Saved coordinates used by a location-based vault lock.

Password and vault information is processed and stored locally using device storage. Biometric authentication, when enabled, is performed by the device operating system. Cypher Stash receives only the result needed to determine whether local authentication succeeded.

3. Operational Diagnostics and Performance

Cypher Stash uses limited pseudonymous diagnostic and performance information to identify crashes, correct software defects, and maintain application reliability. Where required by applicable platform rules or law, collection begins after you authorize it. You may disable operational diagnostics at any time under Settings > Privacy & Diagnostics.

Diagnostic information may include a random application-installation or session identifier, app version, operating-system version, device model or class, crash stack traces, technical exception categories, whether the App was active or in the background, and generic performance measurements such as startup or processing duration.

Operational diagnostic reports do not include your vault files, photos, videos, passwords, security-question answers, filenames, folder names, vault names, private notes, browsing activity, URLs, search terms, text entered into the App, clipboard contents, biometric information, or saved location-lock coordinates.

Forgotten Quarry uses this information only to diagnose software failures, monitor technical performance, and improve application reliability. We do not use operational diagnostics for personalized advertising, remarketing, profiling, or identifying the person using an installation.

Firebase may create random installation and session identifiers for these reports, such as a Firebase Installation ID, Crashlytics Installation UUID, or session ID. These identifiers are not your name, email address, local Cypher Stash username, password, vault identity, or account identifier. Forgotten Quarry does not assign a Firebase User-ID or connect these identifiers to a Cypher Stash account.

Automatic Firebase Performance network-request instrumentation remains disabled. Cypher Stash sends only approved fixed-name custom Performance traces containing durations or numeric counters. It does not create Performance network traces for private-browser traffic.

Platform-Specific Analytics and Subscription Measurement

On iOS, Firebase Analytics and subscription-conversion measurement are controlled by a separate optional privacy choice. If you enable this choice, Firebase may process a random app-instance identifier, app version, operating-system and device class, basic automatically generated application-lifecycle events such as first launch, session start, or application update, general country or region derived from an IP address, and limited subscription-related events used for conversion measurement.

Because events can be associated with the same installation or session over time, this information is pseudonymous and installation-specific, not fully anonymous.

On iOS, Cypher Stash manually sends only a parameter-free subscription_purchase_completed event for a genuinely new, user-initiated subscription when this choice is enabled. The App uses store transaction information only on the device to authenticate the entitlement and suppress duplicate callbacks. It does not attach a purchase token, transaction identifier, order identifier, product, price, vault information, local username, or another user-controlled value to this custom event.

Firebase or the application stores may also generate standard purchase-related events. Those standard events may include limited store-provided information such as a product identifier, value, currency, quantity, or subscription status. Cypher Stash does not manually add payment-card information, billing addresses, local usernames, passwords, purchase tokens, transaction identifiers, or order IDs to Firebase Analytics.

Cypher Stash's iOS build includes Google's on-device conversion measurement using event data. It does not use the first-party email or phone-number measurement variant, Firebase Authentication, IDFA, or an App Tracking Transparency request for this purpose. Event-data on-device conversion measurement is not active for users in the European Economic Area, United Kingdom, or Switzerland. Cypher Stash does not collect another identifier to work around that limitation and instead relies on permitted privacy-preserving aggregate or modeled measurement, including available SKAdNetwork-compatible measurement.

On Android, Google Play is the authoritative source for subscription acquisition conversions supplied to Google Ads. Cypher Stash does not manually send subscription_purchase_completed on Android and does not ask Android users for a Firebase subscription-conversion choice solely for Google Ads. Google Play Billing verification, entitlement handling, restores, and renewals continue independently of advertising measurement.

4. How We Use Technical Information

Forgotten Quarry uses permitted operational diagnostics and technical telemetry only to:

  • Identify, diagnose, and correct crashes and software errors;
  • Measure and improve application reliability and technical performance;
  • Determine whether a new version of the App is functioning as intended;
  • Measure whether an advertising campaign resulted in an installation or subscription; and
  • Prevent duplicate subscription-conversion reporting.

We do not use this information to inspect vault contents, monitor private browsing, create a personal profile, personalize advertising, conduct remarketing, determine a person's identity, or make decisions about an individual user.

5. Subscription and Advertising Conversion Measurement

On Android, Google Play supplies eligible subscription conversion information directly to Google Ads. The App does not create a duplicate custom Firebase acquisition conversion for the same Android subscription.

On iOS, Cypher Stash may use Firebase Analytics, Apple's SKAdNetwork-compatible measurement, Google's event-data on-device conversion measurement where available, and Google Ads to determine whether advertising resulted in an installation and an initial subscription. Firebase may associate the event with a random app-installation identifier and limited advertising-attribution information. Forgotten Quarry uses this information only to evaluate advertising performance. We do not receive or create a customer profile identifying the subscriber by name, email address, phone number, local Cypher Stash username, password, or vault contents.

Only a genuinely new iOS subscription is intentionally logged by Cypher Stash as the custom subscription_purchase_completed advertising event. A restored entitlement, repeated purchase callback, transaction replay, relaunch entitlement processing, ordinary renewal, or cancellation is not intentionally logged as that custom acquisition event.

We do not use subscription-conversion data for personalized advertising, remarketing, or user profiling.

6. Your Privacy Choices

Cypher Stash provides the following privacy choices:

  1. Diagnostics and Performance — operational diagnostics normally used to maintain reliability, including sanitized Crashlytics reports and approved fixed-name Performance Monitoring traces. Where prior authorization is required, collection begins only after authorization. You may disable this category at any time; and
  2. Subscription & Advertising Measurement on iOS — a separate optional choice permitting limited Firebase Analytics and privacy-preserving installation and initial-subscription attribution. Android does not present this Firebase measurement choice solely for Google Ads because Android acquisition conversion measurement is sourced from Google Play.

Using the App without operational diagnostics or declining iOS subscription measurement does not prevent access to the App, a paid subscription, or any paid feature.

The App stores your privacy choices locally on your device. You may change them at any time under Settings > Privacy & Diagnostics.

Withdrawing permission stops future collection for the applicable category after the setting is applied. Information already transmitted may remain in Firebase for the applicable service-retention period. Because Forgotten Quarry does not maintain an account linking you to a Firebase installation identifier, we may be unable to locate an existing pseudonymous record using your name or email address.

Settings > Privacy & Diagnostics also provides a Delete Diagnostic Data & Disable Collection action. This action persists an opt-out for Analytics, Crashlytics, and Performance Monitoring; clears the App's local support-diagnostics cache; deletes unsent Crashlytics reports; resets the Firebase Analytics app-instance identifier using Firebase's supported reset function; and requests deletion of the current Firebase Installation ID through Firebase Installations.

See the Cypher Stash Data Deletion page for step-by-step instructions, the types of data deleted or retained, and applicable retention periods.

The action does not delete your vault, subscription, or paid features. If you later enable collection, Firebase may create new pseudonymous installation, Analytics, Crashlytics, or session identifiers. Forgotten Quarry does not create or retain a mapping between the deleted and replacement identifiers.

Previously transmitted Analytics or diagnostic information may remain for Firebase's applicable retention or deletion period. Forgotten Quarry cannot locate pseudonymous telemetry by your name or email address because Cypher Stash does not send those details with telemetry and does not maintain an identifying mapping between a person and Firebase installation identifiers.

Cypher Stash does not request permission to track you across other companies' apps or websites, does not use Firebase data for personalized advertising, and does not intentionally collect Apple's IDFA or Android's Advertising ID.

7. Permissions Used by the App

Cypher Stash requests device permissions only when needed for a feature you choose to use.

Camera

Camera access may be used to capture photos or videos directly within the App. Captured media is stored locally in your vault and is not transmitted to Firebase.

Photos, Media, and Files

File or media access may be used to import content into a vault or export content to a location you select. Cypher Stash does not scan or upload your unrelated files.

Location

Location access may be used for an optional location-based vault lock. The App may compare the device's current location with coordinates saved locally on the device. Saved lock coordinates are not transmitted to Firebase for analytics, advertising, or diagnostics.

Device Sensors

Device sensors may be used for optional local security behavior, such as a face-down or orientation-based action. Sensor readings are processed locally and are not stored in Firebase.

Biometrics

When biometric unlocking is enabled, authentication is handled by the device operating system. Cypher Stash does not receive or store the underlying biometric template.

8. Local Storage, Exports, and Backups

Vault content is stored locally on your device. Forgotten Quarry does not maintain a cloud copy of your vault.

When you export, share, or back up information, the destination you select may receive and store that information under its own privacy and security practices. You are responsible for choosing and securing any export or backup destination.

Deleting the App or clearing its local data may permanently delete locally stored vault information unless you previously created a backup.

9. Third-Party Service Providers

Cypher Stash may use:

  • Google Firebase, including Analytics, Crashlytics, Performance Monitoring, and related installation or session services;
  • Google Ads, for limited subscription-conversion measurement;
  • Google Play, for Android purchases and subscriptions; and
  • Apple App Store, for Apple-platform purchases and subscriptions.

These providers may process limited information as described in this Policy and under their own applicable privacy policies and terms.

Forgotten Quarry does not sell personal information or vault content. We do not disclose vault content, credentials, filenames, private-browser activity, or user-entered text to advertising or analytics providers.

10. Data Retention

Forgotten Quarry does not maintain a separate database containing Firebase user profiles and does not maintain an ongoing raw BigQuery export of Cypher Stash Analytics data.

We configure Google Analytics user-level event retention to the shortest practical available period, currently two months, with reset on new activity disabled.

Google currently states that:

  • Crashlytics generally keeps crash stack traces and associated installation identifiers for 90 days before beginning deletion;
  • Performance Monitoring generally keeps IP-associated events for 30 days and installation-associated or de-identified performance information for 60 days before beginning deletion; and
  • Certain Firebase installation identifiers may remain until the identifier is deleted or reset, after which removal from live and backup systems may take additional time.

These service-specific periods may change as Google updates Firebase. Locally stored vault information remains on your device until you delete it, clear the App's data, or uninstall the App.

Apple and Google may retain purchase and subscription records under their own legal obligations and retention policies.

11. Data Security

We use privacy-focused design measures intended to reduce the amount and sensitivity of information transmitted from the App. These measures include local vault storage, password-protected access, separation of private content from telemetry, and restrictions on the information permitted in Firebase events, crash reports, and performance traces.

No storage or transmission system can guarantee absolute security. You are responsible for securing your device, credentials, exports, and backups.

12. Children's Privacy

Cypher Stash is not directed specifically to children under 13. We do not knowingly collect directly identifying information from children through the App.

If you believe information has been collected from a child in a manner inconsistent with this Policy, contact us at the address below.

13. International Processing

Google and the mobile application stores may process technical or transaction information in the United States and other countries where they operate. Their processing is governed by their applicable terms, privacy policies, and data-protection commitments.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in the App, applicable requirements, or the services we use. The revised Policy will display a new Effective Date.

If a change materially expands the purposes or categories of information collected through the App, we will provide an appropriate notice or request a new choice where required. Continued use of the App does not replace consent where consent is required.