Privacy Policy

1. Scope and contact

This Privacy Policy applies to the Vignetra mobile application, this website, and related support and account services (together, the “Service”). The Service is operated by RyKlick LLC, a New York limited liability company, which is responsible for the personal information processed through it as described in this policy. In this policy, “Vignetra,” “we,” “us,” and “our” refer to RyKlick LLC.

Questions, privacy requests, and complaints can be sent to privacy@vignetra.com. Please do not email photos, face images, passwords, authentication codes, or other sensitive media.

This policy does not govern the privacy practices of Apple (including Apple Maps), Google (including Google Maps), Firebase, your device manufacturer, your mobile carrier, or other independent services you choose to use.

2. Vignetra’s privacy architecture

Vignetra separates sensitive library intelligence from account metadata:

• On-device processing. Authorized media, thumbnails used by the app, local media references, visual embeddings and labels, face feature representations and groups, person names, search indexes, and card rendering are processed and stored locally.
• On This Day widget. So the widget can show a memory without opening the app, Vignetra keeps small thumbnails of up to a week of upcoming On This Day moments, with their place names and dates, in private on-device storage that only Vignetra and its widget can read (an App Group on iOS and app storage on Android, both excluded from device backups). Hidden moments are never included. These copies never leave your device. They are removed when you delete your account or when a different account’s data replaces this device’s Vignetra data, and with the app if you remove it. Logging out, with either log-out choice, leaves them in place, just as it leaves your moments on the device.
• Optional account sync. If you sign in, profile information and selected organizational metadata—such as captions, corrected locations, hidden or viewed state, and preferences—can be stored in Firebase so supported details can follow you to another device.
• Self-declared account boundary only at authentication. The private local guest experience begins without age collection. Immediately before account creation or sign-in through Apple, Google, or email/password, a date entered in the app is evaluated on the device to determine whether the declaration is under 13 or 13+; the date is not stored by Vignetra. Wherever your phone provides an age range (Apple’s Declared Age Range or Google Play Age Signals), Vignetra uses it, sends only that range with the declaration, and the declaration cannot contradict it. This is a warning and self-declaration, not proof of age, and the declaration relies on information supplied by the person and does not independently verify identity or guarantee accuracy. An under-13 declaration cannot create or enter an online account and returns to the private local guest experience. A declaration of age 13 or over may continue to authentication and account, cloud, and social features. Vignetra does not operate a guardian-approval override for an under-13 account. For an account, Vignetra keeps only the resulting age range—13 to 17, or 18 and older—never the date of birth. Anyone can be found by username unless they turn off “Let people find me” in Settings › Privacy. People aged 13 to 17 have added protections: to anyone who isn’t their friend they show only their first name, username and initials, with no photo, About line or counts. Adults can add each other. An adult and a teen can add each other only when they have a friend in common or are both active members of the same circle, and two teens can add each other when both of their phones confirm (through Apple’s Declared Age Range or Google Play Age Signals) that they are under 18. Otherwise people add each other only in person, by scanning the live QR code shown in the Vignetra app with Vignetra’s own scanner: the code is a single-use token that changes about every 25 seconds, expires within 45 seconds, is revoked when the screen closes or a screenshot is taken, and is hidden while the screen is recorded (on Android the screen cannot be captured). A profile link follows the same rules as search and never unlocks adding on its own. An account created before age ranges were kept is asked for its range once and has the teen protections until it answers.
• Explicit encrypted sharing. Vignetra never uploads your library automatically. When you choose a moment or create a photo card and select an audience, the app creates an encrypted copy and uploads only that ciphertext to Firebase Storage. Private shared metadata, face labels, image descriptions, card messages, captions, and comments are likewise encrypted on the device.

Because your original media and local indexes are not backed up by Vignetra, they may be unavailable if you lose access to the device or remove the media from its photo library.

3. Information Vignetra processes

3.1 Information you provide

• Account and profile details: first name, unique username, optional 80-character About line, optional profile photo, friend count, email address or private relay address, Firebase account identifier, Apple or Google provider account identifier where applicable, and authentication status. Your first name, username, About line, profile photo, and friend count are social profile data visible to eligible signed-in users in account search, profiles, requests, friendships, and sharing surfaces. Your friend list and moments are not public.
• Email/password authentication: people who pass the 13+ eligibility boundary can create or enter an account with email/password, and can request a password-reset message. Firebase Authentication handles those credentials and reset messages. Vignetra does not receive, store, or log the raw password or send it to its callable backend.
• Account age-eligibility status: an under-13 or 13+ result, for an account its age range (13 to 17, or 18 and older), your “Let people find me” choice, the self-declaration method, the check date, and online-access status. Vignetra does not store the date of birth entered in the app. This status is not proof of age. An under-13 declaration cannot be used to create or enter an online account; no guardian-approval override is offered.
• Moment and social details: captions, comments, location corrections or labels, hidden state, viewed state, friend requests, friendships, blocks, hearts, selected audiences, card layouts, card image descriptions, private Favorite and moment-alert choices, recent friend-interaction timestamps used to order your Relevant feed, reports, and other choices you make. Vignetra does not inspect encrypted card messages, captions, comments, or media to rank that feed.
• Preferences: settings needed to preserve your chosen experience, such as feature and display preferences.
• Communications: the email address, message, and any information you voluntarily include when contacting support.
• Purchase information: if paid features are introduced, the applicable app store handles payment credentials. Vignetra may receive a transaction identifier, product, entitlement, price region, purchase status, and validation result, but not your full payment-card number.

3.2 Information processed on your device

Depending on the permissions and features you enable, Vignetra may process the following locally:

• photos, videos, thumbnails, and media identifiers you authorize through system photo permissions;
• capture dates, media type, dimensions, duration, favorites or album-related state made available by the platform, and embedded location coordinates;
• calendar event titles, times, and locations when you separately authorize calendar access;
• visual embeddings and machine-generated scene, object, and color signals used to match natural-language searches;
• detected face regions, numerical face feature representations, similarity groups, review state, and the person names you choose to add;
• card layouts and crops, card rendering, and the photos or moment thumbnails you choose to place in a card;
• voice-search transcripts returned by the operating system’s speech-recognition service and placed into the Ask field for your review;
• local database records, caches, viewed history, and operational state used to make indexing and swiping responsive.

These local results are used to organize and search the library on that device. Face vectors, face crops, persistent face identifiers, visual embeddings, and thumbnails of unshared media are not synced to your Vignetra account. When you explicitly share, Vignetra may upload a small encrypted preview protected by the same audience access and content key so an authorized friend can see the moment in your private friend profile without first downloading the full-resolution media. If you explicitly share a moment that contains a name, the app can include a share-scoped label and display position inside the encrypted payload; it does not upload the local recognition profile used to find that face.

3.3 Voice input

Ask by voice is optional and activates only when you tap the microphone. Vignetra asks the operating system to convert a short spoken question into editable text. Depending on the device, language, network, and system settings, Apple, Google, or another platform speech provider may process audio and transcription data under its own privacy notice. Vignetra does not intentionally record, upload, or retain a voice recording. The returned transcript appears in the Ask field so you can review or edit it before searching your authorized library.

3.4 Siri and Shortcuts

Siri and Shortcuts are optional. When you use a supported Siri phrase, a Shortcut, or a system in-app search to invoke Vignetra, the operating system gives Vignetra the search text so it can open Ask and run the requested search. Vignetra uses that text only to provide the requested search of the photos, places, and details you have authorized it to use.

Vignetra does not provide Siri with your photo library, photo metadata, local visual indexes, face data, or search results through this feature. If the app interface is not ready when a request arrives, the search text is temporarily held on your device only until Vignetra can deliver it to Ask; it is then cleared, and it is also cleared by Vignetra’s account and local-data erasure controls. Apple’s independent handling of Siri and Shortcuts requests is governed by Apple’s privacy terms.

3.5 Information stored with an account

If you sign in, Vignetra may store the following in Firebase:

• your Firebase user identifier, sign-in provider, first name, email or private relay email, unique username, optional About line, friend count, optional profile-photo path, and the profile photo you choose to upload;
• your self-declared 13+ eligibility result, age range (13 to 17, or 18 and older), “Let people find me” choice, declaration method, and online-access status; a server-only people-search entry (your username and who may find you) exists only while you are findable;
• for the optional Vignetra Pioneer program, a one-way hash of a random app-installation identifier linked to each signed-in account that uses that installation, private qualification progress, and the public badge state and program version. The identifier is not a hardware, advertising, or cross-app identifier and is not used for ads or ATT;
• moment captions, corrected place or country names, coordinates you authorize as a correction, hidden state, viewed state, and related timestamps;
• account-safe derived keys used to associate metadata with the corresponding library item where the app can resolve it on another authorized device;
• friend requests and connections, block relationships, shared-moment membership, hearts, notification records, device push tokens, and safety reports. A report ordinarily contains account identifiers, a category, optional details, and an optional share identifier. Account and friend-request reports are metadata-only. A report about a moment, card, or comment includes that exact reported item as private evidence;
• public encryption keys, the list of devices signed in to your account (device kind such as “iPhone” or “Android phone”, when each was last active, and whether you asked to sign it out), short-lived “a new device signed in” notices, encrypted private-key recovery envelopes, and short-lived device-approval requests that expire after 10 minutes. Private-sharing key custody (effective once the updated app and service are released; until then the previous arrangement described here applied, in which a wrapping key for the recovery envelope was also held by our service): your private-sharing key is made on your device. The secret that unlocks it stays on your devices and reaches a new one only through iCloud Keychain on Apple devices, Google’s end-to-end encrypted Block Store backup on Android devices with Google Play services, or your approval on a device you are already signed in to, which seals it to the new device after you confirm a matching 6-digit code on both screens. Vignetra’s servers keep only a copy locked with that secret and relay approvals they cannot open, so Vignetra cannot open your shared moments. Accounts move to this arrangement the first time they open the updated app. Android devices without Google Play services keep the previous arrangement until Block Store is available on them. If a new device cannot receive the secret and you do not approve it from another device, it starts a new key: new moments work there, but moments shared before cannot be opened on it. Signing a device out from Settings → Devices removes the keys to private moments from that device the next time it connects;
• ciphertext for the moments and cards you explicitly share, encrypted captions, locations, share-scoped face labels, card images, image descriptions, messages and comment threads, and per-recipient encrypted key envelopes. Firebase can also observe operational information such as object size, media category, sender and recipient account identifiers, audience type, and timestamps;
• app settings, preferences, usage allowances, entitlement state, username-change timestamps, temporary prior-username holds, rate-limit counters, and other anti-abuse or account-integrity records.

If you begin as a guest and then complete your first sign-in on that device, Vignetra automatically associates the clean guest namespace with that account. Supported local captions, locations, and viewed history can then participate in the account’s normal metadata sync. Face names, face vectors, crops, groups, and recognition data stay on the device. If local data is already bound to a different account, Vignetra erases that account-bound local namespace before opening another account rather than merging identities.

3.6 Service, network, and advertising information

When you use online account, map, support, or website features, Vignetra and its service providers may automatically process standard request information such as IP address, approximate region derived from IP, device and operating-system type, app or browser version, timestamps, language, requested endpoint or map area, authentication and App Check tokens, and security or error logs.

The mobile app creates a random, pseudonymous installation identifier kept in that device’s protected storage and sends a limited foreground-activity heartbeat while the app is open. Vignetra uses it only to calculate internal operational totals: distinct active app installations in the last 30 days, distinct active installations in the last 24 hours, and installations recently foregrounded. This applies whether or not you sign in. The private administrator dashboard does not receive your account identity, photo library, moments, captions, comments, search text or results, face data, advertising identifier, device name, precise location, or country from this measurement. Vignetra does not request location permission for it and does not use it for advertising, profiling, or cross-app tracking.

Vignetra may initialize Google’s User Messaging Platform and Google Mobile Ads SDK for designated, non-sensitive surfaces without an account or sign-in age check. Login-age eligibility never enables, disables, or suppresses advertising. Its one advertising effect: after a person declares an age under 18, Vignetra tags later Google Mobile Ads requests as under the age of consent, which turns off personalized ads and remarketing for those requests; child-directed treatment is never requested. Without a declaration, age-treatment flags remain unspecified or at their default, and Vignetra applies a global G content ceiling to every request. On iOS, App Tracking Transparency is a separate advertising-consent choice and is not age verification. Google may process an IP address (which can estimate general location), device and advertising identifiers, ad-impression and other ad-interaction information, app-interaction information, crash logs, and performance data for ad delivery, measurement, fraud prevention, analytics, and—where permitted by the independent UMP and ATT choices—ad personalization. Vignetra does not send Google your photo library, local face data, visual-search text or results, account profile details, friend graph, captions, comments, location corrections, or encrypted moment and card content for advertising.

4. Advertising and privacy choices

Ads help fund Vignetra. Ad delivery is available regardless of whether login-age eligibility is unknown, under 13, or 13+, and declining a privacy choice never limits your moments, friends, or privacy controls. Login-age eligibility controls only provider authentication and account, cloud, social, and account-notification access. It never enables, disables, or suppresses ads or ATT. A declaration under 18 only tags later ad requests as under the age of consent (no personalized ads); without a declaration, Google Mobile Ads age-treatment flags remain unspecified or at their default, and all requests use a global G content ceiling.

On iOS, ATT remains integrated while Vignetra includes advertising, and no login-age or account state suppresses the request. Vignetra asks through Apple’s system App Tracking Transparency dialog whenever its status is not determined: after the Photos choice while the final onboarding step remains visible, or later when Today appears if the choice is still undetermined. The operating system, region, account settings, or device restrictions determine whether the prompt is available and can appear; Apple may not present it again after it is answered or restricted. ATT is not part of sign-in: it controls tracking permission, does not verify age, and does not make someone eligible for an online account. If you choose “Ask App Not to Track,” or the system denies or restricts permission, Vignetra does not access that identifier. Ads continue under the resulting consent state, so you may still see non-personalized, limited, or technically delivered ads as permitted by applicable law and Google’s ad-serving controls.

For users in places where advertising consent or opt-out choices are required, Vignetra uses Google’s User Messaging Platform to present the applicable message before requesting ads. When Google requires an ongoing choice entry point, you can return to Settings › Ad privacy choices in the app to review or change that choice. Google’s own information about how it uses data when you use its partners’ apps is available at How Google uses information from sites or apps that use its services.

5. How information is used

Vignetra uses information to:

• provide moments, timeline, map, typed or voice-assisted visual search, local familiar-face grouping, private friend sharing, photo cards, comment threads, hearts, notifications, captions, and other features you request;
• create and secure an optional account, display your public profile basics, enforce first-name, About, unique-username, protected-name, and change-limit rules, sync supported metadata, and help restore private-sharing access on a compatible device without displaying a recovery code;
• show relevant dates, locations, and calendar context where authorized;
• process account deletion, privacy requests, subscription validation, and customer support;
• serve, measure, secure, and—only where permitted by the applicable consent and platform choices—personalize advertising;
• maintain security, prevent fraud and abuse, diagnose failures, and protect the Service and its users;
• calculate private Vignetra Pioneer progress, deduplicate qualifying friends that use the same app installation, and display the active Pioneer milestone on eligible profiles;
• understand aggregated app-installation activity and current foreground availability for service operations, capacity planning, and reliability; and
• comply with legal obligations and enforce the Terms of Use;
• improve performance and reliability using aggregated or de-identified information where reasonably possible.

Vignetra does not sell your photo library, local face data, or encrypted private moment content, and does not use those materials to train a general-purpose model or target ads. Where personalized advertising is permitted by the applicable consent and platform choices, Google’s ad technology may use advertising-related data as described above.

6. Legal bases for processing

Where laws such as the GDPR or UK GDPR require a legal basis, Vignetra relies on:

• Performance of a contract to provide requested app, account, metadata-sync, support, and purchase features.
• Consent for system permissions, optional people grouping, and other processing where the law requires consent. You can withdraw consent through the app or system settings, although this does not make earlier lawful processing unlawful.
• Consent or opt-out choices for advertising where applicable, including the Apple App Tracking Transparency choice and Google consent messages. Google may use other lawful bases for strictly necessary ad delivery, security, and fraud prevention where law permits.
• Legitimate interests in securing the Service, preventing abuse, troubleshooting, enforcing rights, and improving reliability, balanced against your rights.
• Legal obligations when processing is necessary to comply with applicable law, a valid legal request, tax, accounting, or consumer-protection duties.

7. When information is disclosed

Vignetra does not disclose your information to data brokers. Information may be disclosed in these limited circumstances:

Service providers may use information only to perform services for Vignetra under contractual or legal restrictions. Open-source libraries running locally do not receive your information merely because their code is included in the app.

8. Face-related and potentially biometric data

When “People in your moments” is enabled, Vignetra uses platform face-detection technology and a local similarity model to detect face regions, create numerical feature representations, and group faces that appear similar. You can review a group and assign a name, ignore it, or remove a name.

• This feature is for organizing your own authorized library, not for authentication, surveillance, or identifying a person against a public or shared database.
• Face images, feature representations, similarity groups, persistent local identifiers, and the local name directory remain on the device and are not synced to Vignetra accounts. Names you gave people go with a shared moment only when you turn on “Include names” for that share (it starts off every time, and appears only when someone in the moment has a name); they are then copied into that moment as encrypted, share-scoped labels for its chosen audience.
• Vignetra does not sell, rent, disclose, or use this data to identify anyone for another user.
• Choosing Turn off stops finding and grouping new faces while keeping saved local groups and names available for private search. Choosing Turn off and remove also erases the saved face groups, feature data, and names from Vignetra’s local database. Neither option changes your original photos or videos.

Depending on where you live, face feature representations may be treated as biometric or sensitive information. Only enable this feature for media you are entitled to process, and do not add a person’s name where doing so would violate their rights or applicable law.

9. Retention and deletion

• Local app data remains until it is replaced through normal indexing, you use a relevant deletion or feature-off control, clear app data, or remove the app. The operating system may preserve certain device backups according to your system settings.
• Account metadata generally remains while your account is active. Using “Delete account” requests deletion of the Firebase account and associated Vignetra cloud metadata, and removes the account’s data from that device: friends’ shared moments and the faces read from them, sharing keys, push tokens, the age check, and profile caches. What Vignetra learned from your own library on that device (its search index, text read in photos, your face groups and names, Today choices, and the On This Day widget) stays, so you can keep using Vignetra without an account, unless you turn on “Also erase what Vignetra learned on this iPhone” (on iPad or Android, “this iPad” or “this device”) in the confirmation. You can also erase it later by removing the app.
• Vignetra Pioneer records include a one-way hash of the app-generated installation identifier, private qualification progress, and public badge state. The installation claim survives ordinary logout so another person’s valid progress is not reset. It is removed with account deletion. The badge confirms only the Pioneer community milestone and does not verify identity or imply endorsement.
• Anonymous installation activity uses a random installation identifier separate from an account. The current installation record is deleted after 31 days without a heartbeat. A daily activity marker containing that same pseudonymous identifier is deleted after 93 days. The private dashboard retains only the resulting limited date-range counts while the markers exist; it does not show per-installation histories.
• Age-eligibility records contain only an under-13 or 13+ result, for an account its age range (13 to 17, or 18 and older), declaration method, and check date—not the entered birth date. The age range is kept with the account until it is deleted; a teen range can be changed to adult no more than once every 30 days. For a declaration under 18, this device also keeps an under-18 marker used only to tag ad requests as under the age of consent; the marker itself is never sent to Vignetra (only the resulting account age range is) and lapses five years after the declaration. The result is a self-declaration rather than proof of age and is scoped to the person using the device; ordinary provider logout does not by itself change that person. A 13+ result expires after 365 days, and an under-13 result expires after 31 days. Device erasure, account deletion, and detected fresh-install recovery also clear it. A legacy result that does not establish 13+ eligibility is never accepted for sign-in and must be checked again.
• Encrypted shares remain until the owner deletes the share, removes a recipient, or the account is deleted. Owners choose whether Vignetra permits recipients to save or export a copy. Deleting a share removes the encrypted service copy and access records, but cannot remove copies a recipient previously saved with permission or captured using device or external tools.
• Safety reports contain the reporting and reported account identifiers, reason category, optional description, and optional item identifier. Account and friend-request reports are metadata-only. A report about a moment, card, or comment includes that exact reported item as private evidence and immediately removes it from the reporter's feed and access while it is reviewed. Evidence is copied into an isolated encrypted safety-evidence store, can be opened only by authorized verified reviewers for a recorded case reason, and is normally deleted 30 days after case closure unless a documented extension of up to one year, legal preservation obligation, or active investigation requires longer. Evidence access, case opening, and review outcomes are logged. To protect the reporting system, we also store reporting-rate, duplicate-report, and reviewer-confirmed misuse records; a report that is not upheld alone does not establish misuse. When a reviewer explicitly confirms a policy violation, we keep a reviewer-only repeat-offender record containing the linked case, action, escalation level, and internal note. Account deletion remains available while a restriction or closure is active. Ordinary account and product data is deleted, while narrowly limited safety or fraud-prevention records may be retained separately where lawful. To prevent deletion from bypassing an active action, Vignetra may retain one-way Apple or Google provider-identity fingerprints, a separately keyed one-way verified-email fingerprint, and the minimal action state. The retained record does not contain the provider subject, deleted account UID, raw email, name, photos, or ordinary profile content. Temporary-action fingerprints are deleted when the action expires; closure records remain only for the duration reasonably necessary and legally permitted to enforce the closure. If a reported person deletes their account, open reports about them, their evidence, and that case’s history are kept until the case is closed and then follow the same retention; reports a person made are kept with their identity removed, and if a reviewer later restricts or closes the deleted account, the action is attached to its one-way sign-in fingerprints. While an account is banned or restricted, its moments, comments, comment photos, and profile photos are held on the server out of other people’s reach and are restored if the action ends.
• Security, legal, and backup records may remain for a limited period where technically necessary, required by law, or reasonably needed to prevent fraud, resolve disputes, enforce agreements, or document compliance. They are isolated from ordinary product use where feasible.
• Support communications are retained only as long as reasonably necessary to address the request, maintain support history, comply with law, and protect legal rights.

Deleting a Vignetra account or local index never deletes original media from your system photo library. Deleting an Apple or Google account, or changing an email-account password, does not automatically delete the separate Vignetra account; use Vignetra’s in-app deletion control or contact us.

10. Your choices and privacy rights

In-app and device controls

• Use Vignetra as a guest without creating an account.
• Complete the neutral, self-declared 13+ eligibility warning before online sign-in. The entered date of birth is not stored by Vignetra, and the declaration is not proof of age.
• Choose full or selected photo access and change permissions in system settings.
• Authorize or deny calendar access separately.
• Turn People off while retaining saved names for private search, or choose Turn off and remove to erase local face-related data.
• Allow or deny microphone and speech-recognition access in system settings, and use typed search without voice input.
• Choose whether to invoke Vignetra with Siri or Shortcuts; typed Ask search works without either feature.
• On iOS, choose whether to allow app tracking in Apple’s system prompt or later in iOS Settings. Where shown, open Settings › Ad privacy choices to review or change the Google advertising consent choices that apply to you.
• Add, crop, replace, or remove a profile photo; edit your About line; and change your first name or an available username subject to displayed cooldown and anti-abuse limits. Usernames, first names, and About lines containing slurs or explicit sexual terms are refused.
• Turn “Let people find me” on or off in Settings › Privacy to choose whether people can find you by username. It is on by default for everyone; people who aren’t a teen’s friends see only the teen’s first name, username and initials.
• Edit or remove captions, names, and corrected locations.
• Accept, ignore, or block friend requests; privately review your friend list; remove, silence, resume, or block friends; choose All friends or Selected friends for each share; allow or prevent saving and export; change access; delete a shared moment or card; edit or delete your own comments; and turn hearts on or off.
• Log out and choose the local-data behavior offered by the app.
• Delete your account and associated Vignetra metadata from Settings › Delete account.
• Request correction of an age-eligibility error or deletion of associated information through privacy@vignetra.com. Vignetra does not provide a guardian-approval override for an under-13 account.

Legal rights

Depending on your location, you may have rights to access, know about, correct, delete, restrict, object to, or obtain a portable copy of personal information; withdraw consent; opt out of certain sales, sharing, profiling, or targeted advertising; and appeal a refusal. Vignetra does not use your photo library, local face data, or encrypted sharing content for advertising or conduct legally significant automated decision-making. You can use the advertising controls described above, and can contact us to exercise other applicable rights.

Send a request to privacy@vignetra.com. Describe the right you want to exercise and the account email or username involved. We may need to verify that you control the account. Authorized agents must provide proof of authority, and we may verify the request directly with the account holder. We will not discriminate against you for exercising a privacy right.

You may also complain to your local privacy or data-protection authority. California residents may request the categories and specific pieces of personal information Vignetra holds, sources, purposes, recipients, correction, and deletion as provided by law. EEA, UK, and Swiss residents may contact their supervisory authority and may object to processing based on legitimate interests.

11. Security

Vignetra uses safeguards intended to protect information, including platform permission controls, local app storage, secure token storage, Firebase Authentication, Firebase App Check, deny-by-default Firestore and Storage rules, server-side validation, abuse limits, and client-side encryption for selected private shares. Each recipient receives a separately wrapped content key. Explicitly submitted safety evidence is segregated from ordinary shared-media storage; its decryption key is protected by Google Cloud Key Management Service, reviewer access requires a verified authorized account, and each access is audited.

Client-side encryption protects shared content in transit and while stored, but it cannot prevent an authorized recipient from saving, photographing, or otherwise copying what they can see. No storage or transmission method is perfectly secure. Protect your device and sign-in account or credentials, install updates, and contact us promptly if you believe your Vignetra account has been compromised. In the current app version, the key that opens your encrypted shares is kept on your devices and in your iCloud Keychain or Google Block Store backup, and Vignetra's copy is deleted once your device has saved it; until your device completes that step, Vignetra may hold a recovery copy. If every one of your devices and backups is lost, existing encrypted shares may not be recoverable.

12. International processing

Vignetra and its providers may process account and service information in the United States and other countries where they operate. Those countries may have different data-protection laws. Where required, Vignetra relies on approved contractual safeguards, adequacy decisions, provider certifications, or another lawful transfer mechanism. Mandatory local rights remain available.

13. Children

Vignetra’s online account, cloud, and social features are intended for people age 13 or over. The private local guest experience begins without collecting age or creating an account. Immediately before account creation or sign-in through Apple, Google, or email/password, Vignetra evaluates a date entered on the device only to determine whether the declaration is under 13 or 13+; Vignetra does not store the entered date. This is a self-declared eligibility warning, not proof of age, and the declaration relies on information supplied by the person and does not independently verify identity or guarantee accuracy.

Anyone can be found by username unless they turn off “Let people find me” in Settings › Privacy. People aged 13 to 17 have added protections: to anyone who isn’t their friend they show only their first name, username and initials, with no photo, About line or counts. Adults can add each other. An adult and a teen can add each other only when they have a friend in common or are both active members of the same circle, and two teens can add each other when both of their phones confirm (through Apple’s Declared Age Range or Google Play Age Signals) that they are under 18. Otherwise people add each other only in person, by scanning the live QR code shown in the Vignetra app with Vignetra’s own scanner: the code is a single-use token that changes about every 25 seconds, expires within 45 seconds, is revoked when the screen closes or a screenshot is taken, and is hidden while the screen is recorded (on Android the screen cannot be captured). A profile link follows the same rules as search and never unlocks adding on its own. An account created before age ranges were kept is asked for its range once and has the teen protections until it answers.

An under-13 declaration cannot create or enter an online account, use cloud sync or social features, or register account notifications. The authentication attempt ends and the person returns to the private local guest experience; no account is created through that attempt. A person who declares they are age 13 or over may continue to authentication and online features. Vignetra does not operate a guardian-approval override for an under-13 account.

Advertising and ATT operate independently of that login-age result and remain available whether eligibility is unknown, under 13, or 13+, subject to the user’s privacy choices and system or regional availability. A declaration under 18 tags later ad requests as under the age of consent (no personalized ads), child-directed treatment is never requested, and without a declaration Google Mobile Ads age-treatment flags remain unspecified/default; a global G content ceiling applies. Google’s User Messaging Platform and, on iOS, Apple’s App Tracking Transparency choice independently govern advertising consent and permitted personalization. Those choices are advertising consent, not age verification.

Do not provide a false birth date or use another person’s account session to bypass the online-account gate. If you believe a child under 13 created an account or provided information, or an age-eligibility result is incorrect, contact privacy@vignetra.com so we can investigate, disable online access, correct the record, and delete information where appropriate. See the Age Requirement page for a concise summary. Local laws may impose a higher age or additional consent requirements; Vignetra may restrict online features where required while those requirements are assessed.

14. This website and cookies

This landing site is hosted on Firebase Hosting. At launch, Vignetra does not place advertising cookies, analytics cookies, or cross-site tracking pixels on this site. The hosting service may process standard request logs such as IP address, user agent, requested URL, response status, and timestamp for delivery, reliability, abuse prevention, and security.

Email links open your selected email service, whose privacy practices are independent. If Vignetra later adds optional analytics, a mailing-list form, or non-essential cookies, this policy and any required consent controls will be updated before those tools are enabled.

15. Changes to this policy

We may update this policy as Vignetra evolves or legal requirements change. The “Last updated” date will change, and material changes will be highlighted in the app, on this site, or by another appropriate notice before they take effect where required. Continued use after the effective date is subject to the updated policy, but Vignetra will request fresh consent where law requires it.

For questions or requests, email privacy@vignetra.com. You can also review the Terms of Use, Accessibility Statement, or Support page.