Privacy Policy

Effective August 11, 2026

QuickVars is built to know as little as possible. There is no account, no login, and no server — everything you save lives only on your device, encrypted with a key that never leaves your phone's Keychain. This page explains exactly what that means, including the one place QuickVars deliberately makes a narrow, disclosed exception.

What QuickVars stores, and how

Every QuickVar — its name, category, aliases, and value — is encrypted with AES-256-GCM using a single key generated on your device the first time you use the app. That key is sealed in the iOS Keychain behind Face ID or your device passcode; fetching it from the Keychain is the authentication, not a separate step layered on top of it. On disk, nothing is readable except each item's internal id and its creation/update dates — neither of which reveals what the item actually is.

Face ID and your session

Face ID (or your device passcode) unlocks one session at a time — you're not re-prompted for every individual item you look at within that session. The app locks automatically when it's backgrounded, and the Reveal screen re-masks a shown value after 30 seconds regardless.

Siri — two commands, one of them a disclosed exception

"Ask QuickVars to find something" opens the app and runs the exact same Face ID gate as opening it by hand. Siri never sees or speaks the decrypted value in this flow — it only hands your spoken query to the app, which reveals the answer on screen after you authenticate.

"Ask QuickVars to check something" is different, and intentionally so: it authenticates with its own momentary Face ID prompt without ever opening the app, and shows the result once as an inline Siri response. We built this after deliberately ruling out a notification-based version, which would have shown on your Lock Screen without authentication, persisted in Notification Center, and could mirror to your other Apple devices via Handoff. A Siri response shown once, only after Face ID, in reply to something you just asked out loud, doesn't share those failure modes. It is a real, disclosed exception to "the app never returns a decrypted value to Siri" — it exists precisely because it required a name you have to say ("check," not "find") rather than something that happens by default.

Emergency Info — opt-in, item by item

Any item can be marked "Emergency Access" in Add or Edit. Opted-in items get a second, minimal encrypted copy sealed under a separate key with standard device protection but no biometric or passcode gate — reachable from the Lock Screen without Face ID, specifically so a first responder or someone you trust can see it without needing to unlock your phone. This key and this pathway are entirely independent of your main vault's key; nothing else becomes reachable because one item is opted in. Off by default, for every item, always.

Widgets and the Apple Watch app

A Lock Screen widget can show one pinned QuickVar — but never its name or value. The one exception, weighed deliberately: it shows the item's category as a small emoji (a car for a Vehicle-tagged item, for example), so you can recognize which one it is at a glance. Showing the actual name was considered and rejected specifically because a Lock Screen is visible to anyone holding the phone, with no authentication at all — category was the bounded middle ground. Tapping the widget opens the app and still requires Face ID before anything else is shown. The Apple Watch companion works the same way in spirit: it never stores a key or a decrypted value, and every question it asks is a live request to your already-unlocked iPhone, which does the actual decryption.

Backups

Your encryption key lives in the Keychain with device-only protection and never restores to a different device, even from an iCloud or iTunes backup. QuickVars' local database file is also excluded from device backups entirely, so a restore never leaves you with ciphertext you have no way to decrypt — a restored or new device simply starts empty.

What QuickVars does not collect

• No account, login, or user identifier of any kind
• No analytics or tracking SDKs
• No advertising identifiers or ad SDKs
• No location, camera, or contacts access
• No server that any of your saved data ever touches

Children

QuickVars is intended for use by the device owner on their own device and is not directed at children under 13.

Changes to this policy

If this policy changes, the "Effective" date above will be updated. Material changes will be noted in the app's release notes.

Contact

Questions about this policy: privacy@noout.app