Privacy Policy

Last updated October 20, 2026

The short version. Safe Potato is designed so that we cannot see your documents, your contacts, or who you share with. There are no accounts, no analytics, and no advertising. The only data that ever leaves your phone is a document you choose to share, and it leaves encrypted so that only the person you picked can open it.

What the app stores on your phone

Documents you add are encrypted on your device with AES-256-GCM before they are written to storage. The encryption key is split: one half is protected by your iPhone's Secure Enclave and released only with Face ID or Touch ID, the other half is derived from your master password with Argon2id. Your master password is never stored anywhere. Document names, dates, and your list of sharing contacts are also encrypted. If you forget your master password, your documents cannot be recovered by you or by us.

What we collect

Nothing that identifies you. Safe Potato has no user accounts, does not ask for your email address or phone number, and contains no analytics, crash reporting, or advertising SDKs. We do not know who uses the app.

Network connections the app makes

Apple. To confirm your subscription through the App Store. Apple's handling of that data is covered by Apple's privacy policy.
The Safe Potato relay, only when you share. When you send a document to a contact, your phone encrypts it so that only that contact's Secure Enclave key can unwrap it, and uploads the resulting package to our relay. The relay stores only: an opaque recipient address (a hash of their public keys), the package size, and a timestamp. It never receives the file name, your name, the recipient's name, or any readable content. The package is deleted the moment the recipient's phone confirms it has collected it, and in any case after 7 days.

That is the complete list. The app makes no other connections.

Sharing and contacts

Adding a sharing contact means scanning their Safe Potato code in person or on a video call. The code contains only the name they chose and their public keys. Your contact list is stored encrypted inside your vault on your phone and is never uploaded.

If you use "Invite someone", the app opens your phone's contact picker so you can choose one person, then opens Messages with a prefilled invitation that you can edit and send yourself. The app reads only the phone number of the person you pick, uses it only to address that message, and does not store or transmit it.

Camera and photos

Camera access is used to scan paper documents and to scan a contact's code. Photo library access is used only when you choose to import a photo. Scans and imports go straight into the encrypted vault and are not saved to your camera roll.

Security features that affect your data

You can turn on auto-wipe, which permanently destroys every document and key after a number of failed unlock attempts that you choose. You can also wipe the vault manually in Settings. Both are irreversible; we hold no copy and cannot restore anything.

Children

Safe Potato is not directed at children under 13 and we do not knowingly collect information from them. Since the app collects no personal information at all, there is nothing for us to delete, but if you believe a child is using the app in a way that concerns you, contact us.

Changes

If this policy changes, the new version will be posted here with a new date. Because the app has no way to contact you, please check this page from time to time.

Contact

Safe Potato is made by Kal, an independent developer. Questions about this policy: privacy@safepotato.com.