Your files stay on your device
Everything you import into CroBox is copied into CroBox's own App Sandbox on your iPhone or iPad. CroBox has no servers and never uploads your files, file names, tags or notes anywhere.
No account, no tracking
CroBox does not ask you to register or sign in. It does not collect analytics or usage data, and it contains no third-party trackers, advertising SDKs or any third-party code at all.
No network use
CroBox makes no network requests. It works entirely offline, including with Airplane Mode on. If iOS ever shows a network-permission prompt in CroBox's name, it comes from a third-party keyboard with Full Access, not from CroBox; declining it changes nothing about how CroBox works.
How your files are protected
Files live inside encrypted spaces. Where a space has file encryption on (the default), each file's contents are encrypted with AES-256-GCM under a key of its own, and that key is sealed with a master key that only the space's password unwraps. Everything CroBox stores is additionally written with iOS Data Protection. A space created with file encryption off relies on Data Protection and the App Sandbox alone.
File names, tags, notes and thumbnails' metadata are protected by iOS Data Protection. Thumbnails themselves are encrypted under the space's key.
CroBox cannot reset your password and cannot recover your files without it.
No recovery, and not a backup
The same design that keeps other people out keeps us out too. Please understand what that means before you import anything:
- A forgotten password cannot be reset. Your password is not stored and not checked against a copy — it is what the encryption key is derived from. Without it the key cannot be rebuilt, by you, by us, or by anyone else.
- Deleting the app deletes the files. Removing CroBox makes iOS delete its storage, and CroBox keeps no copy anywhere else. (Any device backup you may have taken beforehand belongs to Apple's backup system, not to CroBox.)
- CroBox is not a backup service. It holds one copy, on one device, with no restore of any kind. It is intended for keeping private files while you need them — not as the only place an important file exists. Keep anything irreplaceable somewhere else as well.
- A space can be set to delete itself. Auto-Delete, described below, destroys a hidden space without asking once enough wrong passwords have been entered.
Face ID / Touch ID
If you turn on Face ID or Touch ID, CroBox keeps a copy of the primary space's key in the device Keychain, protected by the biometric enrollment on that device. CroBox never receives or stores biometric data; authentication is performed by iOS. Biometrics is a shortcut only — your password always works, and is the only way in after a restart, a Keychain reset or a move to a new device.
What leaves the app
Only what you explicitly send: a file you share through the Share Sheet, or export to the Files app, or open in another app. CroBox reads from Photos and the Files app only for the items you pick. Files shared to CroBox from other apps pass through an App Group container shared solely between CroBox and its own Share Extension.
Deleting your data
Deleted files move to Recently Deleted and are removed for good after the retention period you choose (30 days by default). Locking a space deletes every decrypted copy CroBox had made for viewing. Removing CroBox from your device deletes everything it stored.
A space you added after the first one can also be deleted on purpose, from inside itself, or automatically: Auto-Delete destroys that space — its files, thumbnails, database and key — as soon as the number of wrong passwords you set (at least ten, counted across everything in CroBox) is reached. It is off unless you turn it on, it applies only to the space it was set on, and what it deletes cannot be recovered.
Children
CroBox is rated 4+ and collects no data from anyone, of any age.
Changes
If this policy changes, the new version will be published at this address and the effective date above will be updated. The app itself will not contact you, because it cannot.
Contact
Questions about privacy: crowall@163.com