Menu
Contact

Legal

Privacy policy

Obscura Vault privacy policy: data processed by the website and the app.

ContentsSupport

In short

Obscura Vault sells no data and contains no advertising, no analytics and no automatic crash reporting. Your files, your library and your archives stay on your Mac and on the media and destinations you choose: Oorun has no access to them. The only data Oorun receives is that of your account and your license, described below.

Account and license

To activate a license, you sign in with the e-mail address and password of your Obscura account. Obscura Vault then talks to Oorun’s license server (api.obscuraflow.app):

  • when you sign in: your e-mail address and password; “Forgot Password?” sends your e-mail address to receive a reset link;
  • when this Mac is registered for the license: an identifier specific to this installation (drawn at random), the name of this Mac, the platform (macos), the version of Obscura Vault, a one-way fingerprint (SHA-256) of the Mac’s hardware identifier — the identifier itself never leaves the Mac — and the product concerned (obscura-vault);
  • at launch, when the network comes back and when you choose “Check Now”: a request for the current license, your limits and your list of devices;
  • when you remove a device: that device’s identifier.

These exchanges send no file, no project name, no file fingerprint and no content of your library. The signed license returned by the server is kept in the library’s License folder, so that it can be verified offline.

Oorun processes this data to manage your account and your license. This processing is based on the performance of the license agreement (or of pre-contractual steps taken at your request) and on Oorun’s legal obligations.

  • Hosting: the license server is hosted by Oracle Cloud Infrastructure (Oracle Corporation, 2300 Oracle Way, Austin, Texas 78741, United States) and reached through the network of Cloudflare, Inc. (101 Townsend Street, San Francisco, California 94107, United States). Where data is transferred outside the European Union, the transfer is covered by appropriate safeguards (the European Commission’s standard contractual clauses or an applicable adequacy framework).
  • Retention: account and device data are kept for as long as your account exists. They are deleted when the account is closed; a device you remove is erased at once.
  • Your rights: under the GDPR and the French Data Protection Act, you can ask for access to, rectification, erasure, restriction or portability of your data, and object to its processing. Write to mtay@oorun.fr stating your request and your account’s email address; you will get an answer within the legal time limits. You can also lodge a complaint with the CNIL (www.cnil.fr) if you believe your rights are not respected.

Without an account, Obscura Vault never contacts the license server.

Update check

At launch, then at regular intervals, Obscura Vault downloads the list of published versions (an appcast.xml file) from GitHub (github.com, a service of GitHub, Inc.), then, if you agree to install a new version, its disk image. Like any Internet request, it gives GitHub your Mac’s IP address and a technical header (name and version of the app and of the Sparkle component). It sends no content of your library, no identifier of your Mac or of your account, and no system profile. GitHub processes this data under its own privacy statement (https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement); Oorun has no access to it.

An update is only installed with your consent, once its signature has been verified. You can turn off automatic checks in Settings › Updates: Obscura Vault › Check for Updates… then only checks when you choose it.

Services you configure

  • Offsite destinations: when you add a destination (Amazon S3, Backblaze B2, Cloudflare R2, MinIO, another S3-compatible service, or a folder on a NAS or a disk), Obscura Vault sends it the archives you choose, as you created them (encrypted if you chose encryption), reads them back to verify them and downloads them to restore them. These services are chosen and paid for by you and process the data under their own terms; Oorun has no access to them. The access keys you enter are kept in your Mac’s keychain.
  • Certificate timestamping: if you enter a timestamp authority (RFC 3161), Obscura Vault sends it, at each issuance, the SHA-256 fingerprint of the certificate, and nothing else. Without an authority, issuing makes no connection.
  • Publishing your key: the public key of the certificates is published by you, at the address you choose. Obscura Vault prepares the file but sends it nowhere.

Where your data lives

  • The library (database, archives, database backups, issued certificates, signed license, certificate settings) is saved on your Mac, in ~/Library/Application Support/com.oorun.obscuravault/.
  • The keys (archive signing and encryption, certificate key, offsite access keys) and your account session are kept in your Mac’s keychain, services com.oorun.obscuravault.secrets and, for offsite destinations, com.oorun.obscuravault.offsite.
  • The application settings are saved in the macOS preferences of your account.
  • Your original files stay where they are. Restores are written to the folders you choose.

Original files

When you import a folder, Obscura Vault reads each file to compute its SHA-256 fingerprint and extract its technical metadata (name, size, dates; for images: dimensions, colour profile, capture date). It never modifies or moves your files. Integrity checks read them again, including in the background at the frequency you choose: macOS may ask you to allow access to the Desktop, Documents or Downloads folders, or to external and network volumes.

Logs and problem report

Obscura Vault writes a few technical logs to the macOS system log, on your Mac (visible in the Console app): archive creation timings, failures to write the library journal. macOS deletes them itself over time. The library journal (Journal screen) stays in the database, on your Mac.

Help › Report a Problem… prepares a report (your description, the version of the app and of macOS, the Mac’s architecture) that you read, then save or copy. Obscura Vault sends it to no one: you decide whether to attach it to the contact form at https://vault.obscuraflow.app/contact.

Personal data in your files

The files you preserve may contain personal data. You, or the organization on whose behalf you act, are their controller within the meaning of the GDPR: it is up to you to define their legal basis, retention period and conditions of access. Archives, their copies on your media and offsite, and database backups are files you manage: to erase personal data, delete it where it is, including in backups taken earlier.

Website audience measurement

This section is about the vault.obscuraflow.app website, not the application: Obscura Vault contains no analytics.

The website is hosted by Cloudflare (Cloudflare Pages) and measures its traffic and performance with Cloudflare Web Analytics. To do so, Cloudflare adds a script to the pages (beacon.min.js, loaded from static.cloudflareinsights.com), which sends its measurements to the website itself (address /cdn-cgi/rum).

  • What is measured: the address of the page you view (without its parameters), the page you came from (referrer) and loading and rendering times (including Core Web Vitals). From these, Cloudflare derives the country, device type, browser and operating system, and counts page views and visits (a visit is a page reached from another website or through a direct link).
  • What is not: no cookie is set and nothing is stored in your browser (no local storage, session storage or IndexedDB). Cloudflare does not track you from one website to another and does not “fingerprint” you from your IP address, User-Agent header or any other data. Your IP address is discarded at the nearest Cloudflare data center and is stored neither in its databases nor in its logs.
  • Visitors from the European Union: the measurement is set to “lite” mode: for visitors connecting to a Cloudflare data center located in the European Union or the European Economic Area, the script is not added to the pages and no measurement is processed. The criterion is the data center that serves you, not your nationality or place of residence: when served by a data center located elsewhere, you are measured like other visitors.
  • Processor: Cloudflare, Inc. (101 Townsend Street, San Francisco, California 94107, United States) processes these measurements on Oorun’s behalf. Where a transfer outside the European Union takes place, it is covered by appropriate safeguards (European Commission standard contractual clauses or the applicable adequacy framework).
  • Retention: Cloudflare keeps the detailed measurements for 7 days, then keeps only a sample of about 10%; Oorun only sees statistics, available for the last six months.
  • Legal basis and objection: this processing is based on Oorun’s legitimate interest in knowing how its website is visited and improving its performance (Article 6(1)(f) GDPR). You can object to it by blocking the script from static.cloudflareinsights.com (content blocker or browser settings): the website works the same without it. You exercise your rights as described in the “Account and license” section.

Contact

For any question: see Oorun’s details in the legal notices.