Privacy Policy

Effective October 15, 2026 · LightSeal (iOS)

This covers capture, sealing, checking files, and purchases.

We don’t host photos

LightSeal does not upload photos or video to our servers. Sealing and checking happen on the phone. This version has no server that stores your media.

Checking files is free and doesn’t go through us.

No accounts

No sign-in. We don’t sell personal data. Toggles live in UserDefaults and usually go away if you uninstall. Free-seal counts live in the Keychain and may sync with iCloud Keychain, so deleting the app does not reset the free allowance. Purchases stay with your Apple ID.

What leaves the device

These features talk to third parties. They typically see your IP and ordinary HTTP metadata — the cost of using the internet, not us selling your photos.

• Apple App AttestUsed when you seal, to show a genuine app. Photos are not sent to Apple as content.
• App StoreApple handles purchases, restores, and subscription status. Payment details don’t pass through us.
• Place namesoff until you askMap previews are drawn by Apple Maps. Place names are looked up only after you tap “Show place names”; the photo’s coordinates are then sent to Apple Maps for reverse geocoding. The photo itself is never sent.
• Trusted timeoff by default, ProWhen on, a random 32-byte value is timestamped before the shutter, then a content hash after sealing. Defaults: Sigstore and FreeTSA. Only 32-byte hashes are sent, never the photo or video. If the network or authority fails, that shot fails.

What stays in the file

• Capture recordalwaysThe device clock time and time since the phone started, plus camera parameters: camera type, Make and Model, and for photos exposure time, aperture, focal length, ISO and flash; for video the configured resolution and frame rate and the exposure and ISO when recording started.
• LocationoptionalIf “Embed location” is on, recent coordinates go into EXIF or the video’s QuickTime location atom and into the signature, together with accuracy, altitude when available, how old the fix was, whether full or approximate location was allowed, and whether iOS reported the fix as simulated or from an accessory. Location travels with the file you send. We don’t collect it separately. Off means we don’t request location.
• Heading and context framePro, optionalWritten into the sealed file for comparison. Heading uses the motion sensors (pitch, roll and compass direction) only while it is on. They don’t prove it wasn’t a recapture. The context frame is a low-res ultra-wide thumbnail that travels with the original, not to our cloud.
• LiDAR depthoptional, off by defaultOn iPhones with LiDAR, rear-camera photos can carry a coarse depth map (at most 48 × 36 points, in millimetres) and the camera’s calibration data. Video and the front camera never record depth.
• Network connection stateoptional, off by defaultWhether the phone was online, which kind of interface was in use (Wi‑Fi, cellular, wired, other), and whether the connection was marked expensive or constrained. It is read passively from iOS: no request is made, and no IP address, network name or nearby device is recorded.
• Trusted time tokensPro, optionalWhen trusted time is on, the authority’s signed timestamp responses are stored in the file.
• Seal credentialIncludes a stable keyId that can correlate files from the same install.

Everything above is signed into the file and goes to whoever you send the original or envelope to. Turn off the optional items before capture if you don’t want to share them.

Permissions

Camera, Microphone (for sound in sealed video), Photos, and Location are requested only when needed. With the matching toggle off, you can still seal without that field. If location is on but there’s no fix, that shot fails. Heading reads the motion sensors, which iOS does not gate behind a prompt.

Analytics

No third-party ads or tracking SDKs. We don’t track you across apps. The privacy manifest declares no tracking and no collected data types that require disclosure.

Children

Not directed at children under 13.

Your choices

• Turn off location, heading, context frame, LiDAR depth, network connection state, and trusted time anytime. Microphone access can be withdrawn in iOS Settings; video then records without sound.
• Manage or cancel subscriptions in Settings.
• Uninstall the app.

Contact

sirouni@gmail.com or Support.

Changes

We may update this policy. Material changes get a new effective date and, when we can, a note here or in the app. Keep using the app and you accept the new policy.