Obscura

1. The Zero-Cloud Principle

Obscura is built on the fundamental premise that your conversations, cryptographic keys, and contact relationships belong exclusively to you. We operate under a Zero-Cloud, Zero-Knowledge standard:

• Zero Remote Servers: Obscura does not own, operate, or connect to any centralized messaging, relay, or database servers.
• No Account Registration: You never provide a phone number, email address, username, or personal identity.
• No Telemetry or Tracking: There are zero advertising trackers, analytics frameworks, or behavioral profiling SDKs integrated into the app.

2. What Data We Process & Where It Stays

All application data is processed and stored 100% locally on your physical device:

• Private Encryption Keys: Generated locally using Curve25519 and stored in hardware-backed secure storage (iOS Keychain / Android Keystore). Private keys never leave your physical device.
• Message Histories & Contacts: Stored inside an isolated, local SQLite database residing in your app’s sandboxed storage directory.
• Encrypted Cipher Drops: When you encrypt a secret message, ciphertext is copied to your local clipboard or displayed as a QR code for manual transport over whichever channel you choose.

3. Device Permissions & How They Are Used

Obscura requests only the absolute minimum permissions required for local cryptographic functionality:

• Camera (NSCameraUsageDescription / android.permission.CAMERA): Used solely to scan public key QR codes during peer-to-peer key exchange. Camera frames are analyzed in real time in volatile memory; photos and video are never captured, recorded, or transmitted.
• Biometrics / Face ID / Touch ID (NSFaceIDUsageDescription / USE_BIOMETRIC): Used exclusively to unlock the app and authenticate vault access via your device's native hardware secure enclave. Biometric data never leaves your device's secure enclave and is inaccessible to the app.
• Clipboard Access: The optional clipboard watcher inspects your device clipboard in transient memory to recognize valid Obscura cipher payloads for instant auto-decryption. Non-matching clipboard contents are ignored immediately. Clipboard data is never saved, uploaded, or transmitted.

4. In-App Purchases & Subscriptions (RevenueCat)

Obscura offers optional in-app subscriptions ("Obscura Pro") to fund independent cryptographic development. Payments are processed directly through Apple App Store (StoreKit) or Google Play Billing:

• We integrate RevenueCat solely for store receipt validation and entitlement management.
• RevenueCat processes anonymous transaction receipts and an anonymous app user identifier ($RCAnonymousID).
• RevenueCat receives zero access to your private encryption keys, contacts, decrypted message content, or personal identifiers.

5. Complete Data Erasure & Control

Because all data is stored exclusively on your device, you have complete control over your data lifecycle at all times:

• You can tap "Erase All Vault Data" in the app Settings to permanently and irreversibly wipe all encryption keys, message histories, and configuration data from your device's storage.
• Uninstalling Obscura immediately purges all local app data and isolated database storage.

6. Children’s Privacy

Obscura does not knowingly collect or solicit any personal information from children under the age of 13.

7. Changes to This Policy

Should this Privacy Policy be updated, the revised version will be published here with an updated "Last Updated" timestamp. Because Obscura does not collect user contact information, we encourage users to review this page periodically.

8. Contact Information

If you have questions, inquiries, or security auditing feedback regarding Obscura's cryptographic privacy model, please contact:

Dylan Călin • Dylan C Software
Email: dylancsoftware@gmail.com
Bucharest, Romania