Privacy Policy

Last updated: October 25, 2026

Camuflo was built to protect you, not to watch you. It does not read your messages, banking apps, email or photos. This policy explains, in plain language, the little we collect and why.

Camuflo is a product of Vyxa.

What stays on your device

This data is created and stored on your iPhone or in your browser and is never sent to our servers:

The groups you create and the apps chosen for each one. On iPhone, apps reach Camuflo as opaque tokens from Apple Screen Time: not even we know which apps they are.
The state of each group (available, locked or hidden) and of Street Mode.
Your progress in the theft kit, and your chosen country and language.

What we collect if you create an account

An account is optional. On-device protection works without one. If you sign in, we store:

Your email and, if you use Apple or Google, the name they send us and an account identifier from that service.
6-digit sign-in codes, stored only as a hash and valid for 10 minutes.
Sign-in sessions: when they were created and last used, when they expire, and the browser or app used. The session token is stored only as a hash.

Subscription

Apple handles billing. We never receive your card or payment details. To know whether your subscription is active, RevenueCat tells us the plan, the start and renewal dates and an anonymous purchase identifier.

What we never collect

The content of any app: messages, chats, balances, emails, photos or files.
Your iPhone passcode, biometrics (Face ID) or passwords for other services.
Your contacts or browsing history.
Advertising data. Camuflo has no ads and uses no tracking tools.

How we use data

The legal bases are performance of our contract with you (GDPR art. 6(1)(b); LGPD art. 7, V) and our legitimate interest in keeping the service secure (GDPR art. 6(1)(f); LGPD art. 7, IX).

To create and keep your account and let you sign in from the app or a browser.
To email you the sign-in code.
To turn protection on while your subscription or free trial is active.
To protect the service from abuse, for example by limiting code attempts and keeping technical access logs.

Future features

Device location, a photo of whoever enters the wrong Camuflo passcode, and a cloud vault do not exist yet. When they arrive, each will work only if you turn it on, with an explicit iOS permission, and this policy will be updated before launch.

Who we share data with

We do not sell or rent your data. We use providers that process data only to deliver the service to us:

Render (hosting for the website, web app and API), in the United States.
Neon (database), in the United States.
Resend (sending the sign-in code email), in the United States.
RevenueCat (status of your App Store subscription), in the United States.
Cloudflare (DNS for camuflo.com).
Apple and Google, only if you choose to sign in with those accounts.

International transfers

Our servers are in the United States. Transfers follow LGPD art. 33 and, for users in the European Union, GDPR safeguards such as the providers’ standard contractual clauses.

How long we keep data

Account: for as long as it exists. When you delete your account, we erase your email, sign-in methods and sessions immediately.
Sign-in codes: expire after 10 minutes.
Sessions: up to 30 days without use, or until you sign out.
Server access logs: for the hosting provider’s retention period, for security.

Your rights

You can confirm whether we process your data, access it, correct it, request portability, withdraw consent and ask for deletion (GDPR arts. 15–21; LGPD art. 18).

To delete your account right now: in the app, open Settings → Account → Delete account. For any other request, email privacidade@camuflo.com. We reply within 15 days.

You may also complain to your local data protection authority, or to Brazil’s ANPD.

Security

All traffic uses HTTPS.
Codes and session tokens are stored only as hashes.
On iPhone, the session token is kept in the system Keychain.

Children

Camuflo is meant for adults protecting their own device. We do not knowingly collect data from children under 13 (16 in the European Union). If that happens, email privacidade@camuflo.com and we will delete it.

Changes to this policy

When this policy changes, we update the date at the top. Important changes will be announced in the app before they take effect.

Contact

Data protection officer: privacidade@camuflo.com