Voynich

1. Who we are

Voynich is developed and published by Y. Ben David (BD TECH). It is a file-encryption and password app for macOS and iOS/iPadOS that encrypts your files and folders and stores your passwords as an encrypted file — all on your device. This policy explains how the app handles information. Questions? support@bdtech.app.

2. Information we do not collect

We do not collect, store, sell, or transmit any personal data. The app contains:

• No analytics or usage tracking
• No advertising and no advertising identifiers
• No third-party tracking or marketing SDKs
• No account, sign-in, or registration
• No telemetry sent to the developer

The app's privacy manifest declares no data collection and no tracking. We never see your files, folder names, the contents of your password vaults, or how you use the app.

Crash diagnostics

If you have chosen to share diagnostics with app developers in System Settings → Privacy & Security → Analytics & Improvements (or, on iOS, Settings → Privacy & Security → Analytics & Improvements), Apple may make anonymized, aggregated crash reports available to us through Apple's systems. This is operated by Apple, is opt-in, and contains no information that identifies you.

3. How your data is encrypted, and where it lives

Everything Voynich protects stays on your device, under your control:

• Files and folders are encrypted in place with AES-256-GCM. The original file is replaced by its encrypted container at the same name and path — the app does not copy your files anywhere else.
• Password vaults are saved as a single encrypted file (a .mdvault file) in a location you choose. The vault is encrypted under your master key; opening it requires that key.
• Decryption happens on your device. When you view an encrypted text file, it is decrypted in memory only and is not written back to disk as visible plaintext.

Because the encryption uses standard AES-256-GCM and a documented file format, your data is never locked inside the app: with your recovery key, the bundled offline decryptors (a standalone Python script and a local browser page that work without a network connection) can decrypt your files and vaults on any computer. Those tools run entirely on your machine and send nothing to us or anyone else.

4. Your encryption key and biometric unlock

• Your key stays on your device. The app generates a random 256-bit encryption key on first use and stores it in your device's Keychain, marked so that it is kept on this device only and is never synced to iCloud or anywhere else.
• Touch ID / Face ID. The app uses Touch ID or Face ID to unlock the vault and to release the encryption key. Biometric authentication is handled entirely by your device's operating system — Voynich only receives a success or failure result and never has access to your fingerprint or face data. Where biometrics are unavailable, the system falls back to your device passcode or Mac login password.
• Recovery. The app can produce a one-time recovery key and an optional passphrase-protected recovery file so you can regain access if you lose your device. These are shown to you and are yours to store securely; the app does not transmit them.

5. Files you store in iCloud or other clouds

Voynich does not have its own cloud and does not sync your data. If you choose to keep your encrypted files or your password vault in iCloud Drive, Dropbox, or another service, that syncing is performed by that service under your own account and settings — not by Voynich. The data remains encrypted by Voynich while it is stored or synced there. The app reads and writes only the files and folders you explicitly grant it access to.

6. Information the app stores on your device

To do its job, the app saves a small amount of information locally on your device. This never leaves your device:

• App settings — your preferences, such as the menu-bar option (macOS) and which entries are collapsed.
• File references — security-scoped bookmarks that let the app reopen the files and folders you granted access to after a relaunch, and the location of your password vault.

You can remove this at any time, and uninstalling the app deletes it.

7. Network connections

The app makes no network connections. It contains no networking code, and on macOS it carries no network entitlement, so it cannot send or receive data over a network. It does not contact any server operated by the developer or any third party.

8. Purchases

Voynich is a paid app purchased once through the App Store. All payment is handled entirely by Apple through the App Store — the app contains no in-app purchases and no payment code, and we never receive your payment details.

9. Third-party services

The app uses no third-party analytics, advertising, or cloud services, and bundles no third-party SDKs. The encryption is provided by Apple's built-in cryptography framework and runs on your device. The offline decryptors shipped alongside the app run locally and send nothing to their authors or to us.

10. Children's privacy

The app is a general-purpose utility, is not directed to children, and does not knowingly collect information from anyone, including children under the age of 13.

11. Data retention and deletion

Because all data is stored locally, you are in full control. Your encrypted files and password vaults stay where you put them and are yours to delete. Uninstalling Voynich removes the app and its locally stored settings and key from your device — keep your recovery key if you intend to decrypt your files again later.

12. Security

The app uses AES-256-GCM authenticated encryption, which detects tampering when a file is decrypted. On macOS it runs inside the App Sandbox, which limits its access to your system. The encryption key is held in your device's protected Keychain, and recovery files are wrapped with a strong key-derivation function (PBKDF2-HMAC-SHA256) so that both the file and your passphrase are required to use them. No security measure is perfect, but Voynich is built so that your data never leaves your device and only you can unlock it.

13. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page.