Privacy Policy

Effective date: 11 october 2026
Last updated: 11 october 2026

1. Our Privacy Commitment

Chryptor is designed to protect privacy by design and by default.

Chryptor is an offline, device-based encryption application. The app is designed so that encryption, decryption, key generation, QR-code handshakes, and file or message preparation happen locally on your device.

No Chryptor account. No login. No tracking. No cloud. No telemetry. No key custody.

Chryptor does not require, create, manage, or maintain user accounts. You do not need to register with Chryptor, log in to Chryptor, provide an email address, phone number, username, password, identity document, or account information to use the Chryptor app.

Through the Chryptor app, we do not collect, track, store, sell, rent, analyse, profile, or monetise your personal data.

In particular, through the Chryptor app, we do not collect:

We do not use advertising SDKs, tracking SDKs, analytics SDKs, profiling tools, behavioural advertising, cookies, fingerprinting, account systems, cloud storage, server-side message relay, key escrow, key recovery, or remote synchronisation in the Chryptor app.

Your data stays on your device unless you choose to export, copy, transmit, back up, upload, scan, share, or otherwise disclose it using your device, operating system, third-party apps, messaging services, email services, storage providers, app stores, cloud services, or other tools outside Chryptor.

XBV does not receive, host, sync or back up your content on any server, and the Chryptor apps cannot send it over the internet. Chryptor keeps your content only on your device, in the vault and in the files and backups you choose to create. XBV does not monitor, inspect or recover it.

Chryptor does not provide cloud storage, hosting, message delivery, file transfer, a backup service, account management, key custody, password recovery, content recovery, managed security or communication services. Chryptor lets you create backups and exports on your device. They are stored where you choose, and they are yours to look after.

The Chryptor app does not ask Android for permission to use the internet. Without that permission Android will not let the app open a network connection at all, so Chryptor cannot send your data anywhere, cannot check in with us, and cannot download anything. This is not something you have to take on trust and not something we could quietly change in an update: the permission list is part of the app, and a test in our build fails if anyone ever adds it.

You can check it this way: On the Play listing, open “About this app”, then “App permissions”, then “See more”. Or put your phone in airplane mode and use Chryptor normally, because nothing in it ever needed a connection.

Two honest limits. The Chryptor Pro Unlocker app declares no permissions at all, so the same is true of it. And if you share an encrypted file out of Chryptor, the app you share it into does have internet access; from that point its privacy policy applies, not ours.

Note about the Chryptor offline keyboard: once enabled it is the keyboard in every app, and the user never has to enable it at all; in encrypt mode keystrokes go into Chryptor’s own box and the host app receives only the ciphertext; in plain mode it behaves like any keyboard and reads the words around the cursor in memory to offer corrections; it keeps no learned-words dictionary and counts nothing, so words enter the personal list only when the user explicitly taps add; that list is sealed under a hardware-backed key; there is no clipboard history, and clips it writes are marked sensitive; it honors the operating system’s “no personalized learning” flag in password fields; it forces plain mode on the lock screen and in PIN, phone and date fields; and it cannot send anything anywhere because the app has no internet permission. Our keyboard cannot send any information anywhere, but it cannot protect you from other software on a compromised phone or from an accessibility service you have granted access to.

Chryptor itself contains no crash-reporting software and sends us no crash reports. Android and the Google Play Store collect crash and freeze information at the system level, independently of Chryptor, and Google shows us some of it in our developer account. We cannot switch that off, and we do not combine it with anything else.

2. Who We Are

For the purposes of applicable privacy and data protection laws, Chryptor is a brand belonging to:

XBV UG (haftungsbeschränkt),

Address: Reisinger Str. 65, 85737 Ismaning

Register Court: Amtsgericht Munich

Registration Number: HRB 299944, VAT: DE453078405
Email: contact@x-bv.de

3. Scope of This Privacy Policy

This Privacy Policy applies to:

This Privacy Policy does not apply to:

Those third parties process data under their own privacy policies and terms.

For users in the United States: Chryptor collects no personal data through the app, so there is nothing to review or change there. To review or correct information you sent us by email, write to contact@chryptor.com. The app makes no network requests and the website uses no tracking, so Do Not Track signals have nothing to act on. We do not sell or share personal data. Changes to this policy are announced as described in section 21.

4. No Chryptor Account Required

Chryptor does not require a Chryptor account to operate.

You can use Chryptor without:

If you download, purchase, install, update, review, or manage Chryptor through Google Play or another app store, you may need an account with that app store provider, such as a Google account.

That account is provided by the app store provider, not by Chryptor.

Chryptor does not receive, store, control, or manage:

Google Play, Google payments, app-store reviews, refunds, subscriptions, download records, device compatibility checks, and related app-store activity are handled by Google or the relevant app-store provider under their own terms and privacy policies.

A Google account used to access Google Play is not a Chryptor account.

Chryptor does not use your Google account as a Chryptor login and does not link your app usage to a Chryptor user profile.

5. What Happens Locally on Your Device

Depending on how you use Chryptor, the app may locally process data on your device, including:

This processing happens locally on your device.

Chryptor does not transmit this information to us.

Chryptor does not have server-side access to this information.

Chryptor does not know:

Chryptor never sends anything. Your phone does. When any app plays a video or opens a PDF, Android’s own components keep statistics about it, and on a phone with Google’s usage and diagnostics setting turned on, some of that can reach Google. That is the operating system, not Chryptor, and you can turn it off in your phone’s settings. We mention it because we would rather you heard it from us.

Chryptor can keep a diagnostic log to help track down a bug you keep running into. It is off when you install Chryptor, and nothing is recorded until you switch it on in Settings.

While it is on, the log records errors and crashes and the names of the app screens you were on when they happened. It never records your messages, files, file names, contacts, passphrases, keys or anything you type. Only the last 24 hours is ever exported. The file on your phone is trimmed to the last 24 hours every time Chryptor starts, every time you export, and whenever it grows past its size limit of 256 KB. Switching the log off deletes it.

The log stays on your phone. Chryptor cannot send it anywhere, because the app has no internet permission. If you want us to look at it, you export it yourself and send it to us by email. Read the file before you send it, so you know exactly what you are sharing.

If you send us a log, we use it only to find and fix the fault. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in fixing defects), or Art. 6(1)(b) GDPR if you bought Chryptor Pro.

6. No Key Custody and No Recovery

Chryptor follows a strict zero-custody model.

We do not centrally hold, escrow, manage, store, receive, reconstruct, or recover:

Because we do not possess your keys, passwords, passphrases, or recovery material, we cannot recover them for you.

If you lose your key, password, passphrase, QR material, device, backup, or encrypted file, your encrypted content may become permanently inaccessible.

This is a privacy and security feature of Chryptor’s architecture, not a support defect.

You are solely responsible for:

7. Limited Support and No Access-Based Troubleshooting

Chryptor is designed so that we cannot see your app content, keys, passwords, logs, identities, device usage, or encrypted material.

As a result, Chryptor cannot provide support that requires access to:

If you contact us for support, we may be able to provide general information, documentation, troubleshooting suggestions, or product updates, depending on availability.

However, we cannot:

Where you voluntarily contact us, we may process the information you choose to provide, as explained below.

8. Information You May Voluntarily Provide Outside the App

Although the Chryptor app itself does not collect personal data, you may voluntarily provide personal data to us outside the app. You never have to give us personal data to use Chryptor. If you write to us, we need your email address to reply.

8.1 Customer communications

If you contact us by email, app-store review, social media, business correspondence, or another channel, we may receive information such as:

Please do not send us:

We do not need such information and may not be able to protect unsolicited sensitive material in the same way Chryptor protects local encrypted content.

8.2 App-store data

If you obtain Chryptor through Google Play or another app store, the app store may process information such as:

This processing is performed by the relevant app store under its own terms and privacy policy.

We do not use Play Console information to identify individual users.

9. Purposes and Legal Bases

Because the Chryptor app does not send us personal data, we do not process app personal data for analytics, advertising, profiling, AI training, behavioural monitoring, product tracking, or marketing.

Where you voluntarily contact us, interact with our website, purchase through an app store, or raise a legal, payment, refund, or support matter, we may process limited personal data for the purposes below.

9.1 Responding to communications

We may process the information you voluntarily provide to respond to your request.

Answering your messages: Art. 6(1)(b) GDPR if you are a customer or about to become one; otherwise Art. 6(1)(f), our interest in answering enquiries.

9.2 App-store administration

We may process limited information made available by an app store to manage distribution, purchase administration, refunds, tax requirements, fraud prevention, reviews, or compliance.

App-store administration: Art. 6(1)(b) for purchases and refunds; Art. 6(1)(c) for tax records.

9.3 Legal and compliance obligations

We may process limited information where necessary to comply with applicable law, tax, accounting, corporate, regulatory, or legal obligations.

Legal basis: legal obligation.

9.4 Protecting rights and security

We may process limited information where necessary to protect Chryptor, our company, legal rights, property, security, or to prevent fraud, abuse, or unlawful activity.

Protecting rights and security: Art. 6(1)(f), our interest in preventing fraud and abuse and defending legal claims.

9.5 Legal requests

We may process and disclose information we actually possess where required by valid legal process, court order, regulator request, or applicable law.

Legal basis: legal obligation.

Chryptor’s operating model is based on data minimisation and privacy by design/default, which are recognised GDPR principles and obligations.

9.6 Android vitals

Google’s Play Console shows us crash and freeze reports that Android collects at system level. We see error traces and device and version counts, not who you are. We use them only to find and fix defects. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in fixing defects. Retention is Google’s, under Google’s policy.

10. Data We Do Not Use

Chryptor does not use app data for:

We do not sell personal data.

We do not share personal data for cross-context behavioural advertising.

11. App Permissions

Chryptor requests only device permissions that are necessary for the functionality you choose to use.

Depending on your operating system and app version, Chryptor may request access to:

These permissions are used locally for app functionality.

You can manage permissions through your device settings.

If you deny a permission, some features may not work.

Chryptor asks for no storage permission. When you pick a file, Android’s own file picker opens and hands Chryptor that single file, so Chryptor never gets access to your storage as a whole.

Chryptor also asks to see one other app on your phone, the Chryptor Pro Unlocker, so it can tell whether you bought Pro. It cannot see any other app you have installed. It asks for no contacts, no location, no microphone, no phone, no calendar and no advertising identifier. Chryptor Pro Unlocker is sold through Google Play. Google processes the payment and the refund, and Google’s rules apply to the purchase, including the refund window Google offers and, for buyers in the European Economic Area, the withdrawal terms in the Google Play Terms of Service. A refund through Google Play uninstalls Chryptor Pro Unlocker, and Chryptor Pro switches off the next time Chryptor checks for it. Nothing in this section limits a right you have by law.

12. Sharing and Disclosure

The Chryptor app does not share app data with us because the app does not transmit app data to us.

We may share limited personal data that you voluntarily provide outside the app only in the following cases.

12.1 Service providers

We may use service providers such as email hosting, website hosting, legal advisers, accounting providers, or business administration tools.

They may process personal data only as necessary to provide services to us.

12.2 App stores and payment providers

Google Play, Apple App Store, payment providers, banks, tax processors, and similar providers may process purchase, payment, refund, review, and distribution information under their own terms.

12.3 Legal reasons

We may disclose information we actually possess if required by applicable law, court order, valid legal process, regulator request, tax authority, or law enforcement request.

13. International Transfers

The Chryptor app does not transfer your app content, keys, files, messages, QR secrets, usage data, or device identifiers to Chryptor servers.

If you contact us, use our website, purchase through an app store, or interact with third-party providers, limited personal data may be processed in countries outside your country of residence.

Your use of third-party services, including Google Play, Apple, cloud storage, messaging apps, email providers, payment providers, and device operating systems, may involve international transfers controlled by those third parties.

Our website and email are hosted by IONOS SE in Germany. We do not transfer personal data outside the EU/EEA ourselves. Google, as operator of Google Play, is responsible for its own processing, including any transfers.

14. Retention

Because the Chryptor app does not collect personal data, we do not retain:

For information you provide outside the app:

Support emails and diagnostic logs you send us: deleted 12 months after your request is closed. Tax and accounting records: kept for the periods required by German law (§ 147 AO, § 257 HGB, generally 6 to 10 years). Correspondence about a legal claim: kept until the claim is settled and the limitation period has ended.

Where we no longer need personal data, we delete or anonymise it unless retention is required or permitted by law.

15. Security

Chryptor’s privacy and security model is based on:

However, no device, software, encryption system, or security architecture can be guaranteed to be perfectly secure.

Your security also depends on:

You are responsible for keeping your device, keys, passwords, recovery material, backups, and encrypted files secure.

16. Your Privacy Rights

Because Chryptor does not collect app data or create Chryptor accounts, in many cases we may not have personal data about you, other than information you voluntarily provided outside the app or information made available through an app store.

If you make a rights request, we may need limited information to verify and respond to the request.

We will never ask you for a private key, a passphrase, a recovery phrase, QR handshake material or any of your encrypted or decrypted content in order to deal with a privacy request. Anyone claiming to need that in our name is not us.

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20), to object to processing based on legitimate interests (Art. 21), and to withdraw consent at any time. Write to contact@chryptor.com, and we will answer within one month. Because the Chryptor app sends us nothing, we usually hold no data about app users at all.

You can also complain to a data protection authority, in particular where you live or work. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

17. Children

Chryptor is not meant for children under 16. We do not knowingly collect personal data from children.

18. Third-Party Services You Choose to Use

Chryptor allows you to create encrypted output that you may choose to store, transmit, upload, back up, or share using third-party tools.

These may include:

Those services are independent from Chryptor.

They may collect:

Their own privacy policies and terms apply.

Chryptor is not responsible for the privacy, security, availability, or legal practices of third-party services you choose to use.

19. Legal Requests and Law Enforcement

Because Chryptor does not collect app content, keys, passwords, passphrases, QR-code secrets, recipient information, account data, or usage logs, we generally cannot provide such information in response to legal requests.

If legally required, we may disclose only the limited information we actually possess, such as:

We cannot decrypt user content.

We cannot recover user keys.

We cannot identify what a user encrypted or decrypted through the app.

We cannot provide Chryptor account information because Chryptor does not create user accounts.

20. No Sale of Personal Data

We do not sell personal data.

We do not rent personal data.

We do not trade personal data.

We do not share personal data for behavioural advertising.

We do not use Chryptor app data for advertising, profiling, or tracking.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we will update the effective date and, where appropriate, provide notice through our website, app listing, release notes, or other reasonable means.

22. Website hosting and server logs

chryptor.com is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, which processes data on our behalf under a data processing agreement (Art. 28 GDPR). To deliver the website, IONOS necessarily processes your IP address and technical request data, and may keep server logs for security and operation under its own retention settings. We do not access, analyse or keep these logs ourselves, and the website has no sign-up forms, accounts or analytics. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in delivering and protecting the website.

23. Cookies

The Chryptor website does not use analytics, advertising or tracking cookies, and it does not load third-party fonts or tracking scripts. If that ever changes, we will update this policy first and ask for consent where the law requires it.

24. Contact

You can contact us at contact@chryptor.com.