How we handle your data

Your local vault

• Photos and videos you capture or import stay in Reliquary's private app storage, encrypted on your phone. They are not saved to the system camera roll or automatically uploaded to a cloud service.
• The local vault does not require sign-up. Reliquary shows no ads, does not use the advertising identifier, and does not include analytics or crash-reporting tools of its own.
• The camera and microphone are used only when you capture. Device biometrics and your app PIN are checked on your phone to unlock the vault. We never receive your fingerprint, face data or PIN.
• Your 24-word Recovery Key protects portable encrypted exports. Reliquary cannot recover a lost Recovery Key for you, and we cannot open your vault. If you lose your phone, clear the app data or uninstall without a backup, your vault cannot be restored.

What our servers hold

• Only if you use secure sharing or Pro: the app creates an anonymous identity with our backend provider, Supabase. It is a random ID, not linked to your email, name, phone number or Google account.
• For each installation we hold an installation ID, a public encryption key, its short fingerprint (the badge your contacts see) and the device label you choose, up to 64 characters. Please do not use your real name as a label.
• For shares we hold delivery details: the sender and recipient installation IDs, size, timing and expiry, plus the end-to-end encrypted payload while it waits for pickup.
• We do not receive your readable photos, your vault contents, your Recovery Key, your contacts, your location or an advertising identifier.

Secure photo sharing

• Trusted-contact sharing is for photos only. The relay temporarily holds end-to-end encrypted photo data, not the readable photo.
• View-once shares are available for up to one hour; standard shares for up to six hours. The relay can see delivery details such as size and timing. Expired shares are removed automatically.
• A successful view-once open removes the relay copy, but it cannot prevent a recipient from taking a screenshot or making another copy.
• Leak tracing is optional and can fail after screenshots, heavy recompression, or edits. It is a best-effort signal, not proof of a leak.

Pro purchase verification

• Buying or restoring Pro sends Apple or Google purchase proof plus app-generated device and installation identifiers to Reliquary's verification service. Payment itself is handled by Google Play or Apple under their own terms. We never see your card details.
• Reliquary does not store or log the raw receipt or purchase token. It keeps a non-readable purchase reference, purchase status and times, and linked installation records.
• Vault media, your Recovery Key, contacts, and shared-photo contents are not sent for purchase verification.
• One purchase supports up to five installations. Offline Pro access must be rechecked at least every seven days. Apple, Google, Supabase, and network providers may observe purchase, IP-address, and request-timing information.

QR pairing and private links

• Pairing a trusted contact scans a QR code with Google's ML Kit barcode scanner, which runs on your phone through Google Play services. The code is read on the device. Google may collect anonymous diagnostic information about the scanner under its own privacy policy. Reliquary does not receive it.
• A pairing code contains your public key, fingerprint and device label. It is shared only with the person who scans it.
• Saved links open in an in-app private browser whose session is cleared when you close it. The website you open, your network and your DNS provider can still see the visit and your IP address. Reliquary does not send the link to us.

Videos, exports, and support

• Reliquary does not upload or store videos on its sharing service. It does not operate video relay or managed video storage.
• You can move a video using an encrypted portable capture or vault backup, then choose the destination through your phone's Share or Save controls.
• Reliquary clears its app-owned temporary export after handoff, but it cannot control, expire, or delete copies kept by another app, cloud provider, or recipient.
• For privacy questions, support messages, or deletion requests about Reliquary's verification records, use the support form. We keep support messages as described in the Home Buyers App support section above.

How long we keep it

• Relay shares are removed when a view-once share is opened, or when the share expires. A scheduled job removes expired shares every few minutes.
• Device, installation and purchase-verification records are kept for as long as we need them to provide Pro, enforce the five-installation limit, prevent fraud and replayed purchases, and meet legal obligations. After that we delete or anonymise them.
• You can ask us to delete them sooner, as described in the deletion section below.

Your rights and choices

• You can ask to see, correct or delete the personal information we hold about you. We respond within 30 days.
• We handle personal information in line with the Australian Privacy Principles. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
• If you live in the European Economic Area, the United Kingdom or California, you may have additional rights, and we will honour them where they apply. We do not sell personal information and do not share it for cross-context behavioural advertising.
• Our service providers may process data in countries other than your own. We use providers that apply their own security and privacy commitments.

Age, security and changes

• Reliquary is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.
• We use encryption and access controls to protect what our servers hold. No system is perfectly secure, and Reliquary cannot protect you from malware on your phone, a compromised device, someone you share a photo with, or being made to unlock your phone.
• If we change this section we will update the date above. Your use of Reliquary is also covered by the Reliquary terms.

How to request deletion

1. Reliquary has no account. To delete the data in your vault, delete items in the app or uninstall it. We cannot recover anything after that.
2. To delete what our servers hold, use the support form and start your message with "Reliquary data deletion".
3. Include the device label you set in Reliquary and roughly when you first used sharing or bought Pro.
4. We send a link to your email to confirm it is you. You will receive confirmation within 2 business days and your data is deleted within 30 days.

What will be deleted

• Your anonymous identity, installation records, public keys and device labels
• Any shares still waiting for pickup
• Your purchase-verification links to your installations

We may keep a non-readable purchase reference and limited records where needed for security, fraud prevention, tax or legal reasons. Deleting records does not cancel a Google Play purchase, and you can restore Pro from your store account.

How to request deletion

1. Open Home Buyers App, go to Profile, then Account, and choose Delete account.
2. If you cannot access the app, use the account deletion request form.
3. We send a link to your account email to confirm it is you.
4. You will receive confirmation within 2 business days. Data is deleted within 30 days.

What will be deleted

• Account details
• Profile information
• Saved properties
• Notes, scores, searches, and app activity