Privacy Policy

Last updated: October 6, 2026

Summary: Sigillarium asks for no account. We collect no name, no email address and no password. Your documents stay on your device and are NEVER sent to our servers: they only leave it if you decide so. We never sell your data to third parties, for the simple reason that we hold none.

Data controller: Loïc MUGUET, entrepreneur individuel (EI), 173 rue de Courcelles, 75017 Paris, France (SIREN 804 839 603). Contact: privacy@sigillarium.app. See the legal notice.

1. Introduction

Sigillarium ("we", "our", "us") is committed to protecting and respecting your privacy. This privacy policy explains how we collect, use, share, and protect your personal information when you use our Sigillarium mobile application.

2. Data Collected

2.1 Authentication Information: NONE

Sigillarium has no user account. There is nothing to create, nothing to remember, nothing to entrust to us. We collect no name, no email address, no password and no phone number. Access to your vault is protected by your device's biometrics or passcode, which never leave it.

2.2 Documents and files — LOCAL STORAGE ONLY

⚠️ IMPORTANT: Your documents, photos, and files stay on your device. We do NOT store them on our servers, we do NOT receive them, and we do NOT have access to them. They only leave it through your own action: sharing a document, or an encrypted backup (§ 2.3).

Documents: Stored in the app's private folder on your device
Photos and scans: Stored locally on your phone only
Watermarks/seals: Applied locally with no transmission to our servers
Metadata: Names, tags, categories remain on your device

2.3 Encrypted vault backup

Creation: the archive is created and encrypted on your device (AES-256-GCM), with a backup key generated on your device. We receive neither the archive nor the key.
Location: you choose where to store the archive. If you use a third-party service (Google Drive, messaging…) or a password manager (Google, Samsung Pass, iCloud…), its terms and privacy policy apply. Avoid entrusting the archive and its key to the same service.
Key copy: a copy of the backup key is kept, encrypted, in your device's hardware keystore (Android Keystore or iOS Keychain), to show it to you after authentication and prefill later backups. It is deleted with the app.
Public format: see Backup format.

2.4 Subscription data

Anonymous identifier: our provider RevenueCat generates a random identifier specific to your installation. It contains no personal information and cannot identify you.
Subscription status: active or not, and its expiry date.
Billing: your subscription is billed by Google Play or the App Store. Those stores know who you are; we do not. Their own privacy policies apply to the transaction.

That's it! We do not collect any other data.

3. Camera Usage

Sigillarium requests access to your camera to allow you to:

Photograph paper documents directly in the application
Take photos of documents to store them locally on your device
Apply watermarks/seals to captured images

Important: Photos taken with the camera are stored exclusively on your device. We never access your camera without your explicit permission, and images stay on your phone, unless you share or back them up yourself. They are never sent to our servers.

4. How We Use Your Data

The only data we process concerns your subscription. It is used to:

Check that your premium subscription is active
Restore your subscription when you change device
Prevent subscription fraud

Since we do not have your email address, we cannot write to you: anything concerning your subscription goes through the app store.

We do NOT use your data to:

❌ Store your documents (they remain on your device)
❌ Analyse your documents
❌ Serve targeted advertising
❌ Sell your data to third parties

5. Data Sharing

We hold no personal data, so we neither sell nor share any. The only third parties involved in running the app are:

5.1 Service Providers

RevenueCat: premium subscription management (anonymous identifier, subscription status)
Google Play / App Store: subscription billing. We receive no personally identifying data from them.

Important note: We never share your documents: only you can share or back them up.

5.2 Legal Obligations

We may disclose your information if required by law or to:

Comply with a legal obligation
Protect our rights or property
Prevent or investigate potential misconduct
Protect the safety of users or the public

6. Data Security

We implement security measures to protect your data:

Secure local storage: Your documents are stored in the app's private folder on your device, inaccessible to other apps
AES-256-GCM encryption: every document in the vault is encrypted on your device, as is the database holding its metadata, using SQLCipher
Local authentication: biometrics (fingerprint, face) or the device passcode. A screen lock is required to open the vault
Hardware-backed key: the key that encrypts your vault is held in your device's Android Keystore or iOS Keychain. It never leaves the device, and we have no access to it — including under legal compulsion
No transmission: Sigillarium never sends your documents over the Internet

7. Data Retention

7.1 Data on our servers

We hold no personal data about you. The only existing record is that of your subscription at RevenueCat, attached to an anonymous identifier. It is kept for the duration of the commercial relationship and the accounting and tax obligations attached to it.

If you uninstall the app, that identifier becomes unusable: nothing links it to you.

7.2 Documents on your device

Your documents remain on your device. You have full control over them:

Delete them at any time from within the app
Uninstall the app to remove all local documents
Backup archives you have exported are not deleted by uninstalling: delete them wherever you stored them
We have NO access to this data

8. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

Right of access: Obtain a copy of your personal data
Right to rectification: Correct inaccurate or incomplete data
Right to erasure: Request deletion of your data (see deletion terms)
Right to data portability: Receive your data in a structured format
Right to object: Object to the processing of your data
Right to restriction: Request restriction of processing

To exercise these rights, contact us at: privacy@sigillarium.app

These rights concern data we largely do not hold: there is no account, no profile and no history to access or correct. Your documents are under your sole control on your device; to take them with you, use the encrypted backup (§ 2.3). See our data deletion page.

9. Cookies and Similar Technologies

Sigillarium uses local storage technologies to:

Store your app preferences
Improve app performance

No advertising tracking cookies are used.

10. Protection of Minors

Sigillarium is not intended for persons under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately.

11. International Transfers

Sigillarium transfers your documents nowhere. If you store a backup with a third-party service, you choose its location. The only data that may be stored outside your country of residence, notably in the United States, is the anonymous record of your subscription at RevenueCat. We ensure that this transfer complies with GDPR requirements.

12. Changes to This Policy

We may update this privacy policy periodically. We will notify you of any significant changes via a notification in the app and on this page. The "last updated" date at the top of this page indicates when the policy was last revised.

13. Contact

For any questions about this privacy policy or your personal data, contact us:

Email: privacy@sigillarium.app
Support: support@sigillarium.app

GDPR Compliance

Sigillarium complies with the General Data Protection Regulation (GDPR) of the European Union. Your data is processed lawfully, fairly, and transparently, and only for the specific purposes for which it was collected.