Privacy Policy

Effective date: 2026-07-15 · Estora

In one line: Estora collects nothing. Your data is stored and encrypted on your own device, and if you turn on iCloud sync, it is encrypted before it leaves — Apple only ever sees ciphertext.

Data we collect

None. Estora has no account system, no sign-in, and no servers of its own. We do not collect, receive, transmit, or store your assets, documents, family information, structures, or any usage data. There is nothing for us to sell or share, because nothing ever reaches us.

What stays on your device

• Your records — assets, identity documents, family members, trust structures, risk alerts, and net-worth snapshots — are stored in the app's on-device database.
• Document scans and images are encrypted with AES-GCM before they are written to disk. The key is held in the device Keychain and never leaves the device.
• Preferences such as language and base currency are stored locally.
• Access is protected by Face ID / Touch ID on cold start and on every return from the background.

Network access

Estora is offline by default. It never sends your data anywhere on its own. There are exactly two things that use the network, and neither one includes any of your information:

• Public exchange rates. To consolidate your net worth across currencies, the app downloads a public exchange-rate dataset (including the spot gold price) from free public sources. Only public exchange rates are fetched — your asset data never leaves this device. You can turn auto-update off and keep using the last downloaded rates offline, or edit rates manually.
• iCloud sync and backups you turn on. Optional, off by default, and end-to-end encrypted — described in the next two sections.

iCloud sync (optional, end-to-end encrypted)

If you turn on iCloud sync, your records are encrypted on your device with AES-GCM and only then uploaded to your own private CloudKit database. The encryption key is stored in your syncable iCloud Keychain, which Apple end-to-end encrypts between your devices. Apple stores only ciphertext and cannot read your data; neither can we, since we operate no servers and hold no keys. Your use of iCloud is governed by Apple's privacy policy. Sync is off unless you enable it.

Note: document scans and images are excluded from sync and from backups. They remain encrypted on the device that created them.

Encrypted backups (optional)

You can export an encrypted .estora archive. The key is derived from a passphrase you choose (PBKDF2-SHA256, 600,000 iterations) and the archive is encrypted with AES-GCM. You choose where it goes through the system share sheet — iCloud Drive, Files, AirDrop, or elsewhere. We never receive the archive or your passphrase.

You may optionally save the passphrase to your iCloud Keychain so you can recover on another of your devices; Apple end-to-end encrypts the Keychain and we never see it. If you do not save it and you lose it, the archive cannot be recovered — not by us, not by anyone.

Family sharing (optional, Pro)

If you invite family members, sharing runs through Apple's CloudKit sharing between the Apple IDs you invite. The shared data is encrypted with a family key derived from a passphrase you set, so Apple still only stores ciphertext. You can send read-only invites, and rotating the passphrase re-encrypts the data and cuts off anyone you've removed. We have no visibility into who you share with or what you share.

AI capture — on device only

When you import a photo, PDF, or camera scan of a document, recognition runs entirely on your device using Apple's Vision OCR and, where the device supports it, Apple Intelligence (Foundation Models). Where those are unavailable, an on-device heuristic is used instead. No image, document, or extracted text is ever sent to us or to any third party.

No third parties

• No third-party analytics, advertising, or tracking SDKs.
• We do not track you across apps or websites.
• Subscriptions are processed by Apple's In-App Purchase. We receive only whether a subscription is active — never your payment details.

Storage & deletion

You can reset or erase your data at any time in Settings → Data, or by deleting the app. If you used iCloud sync, deleting the data on a synced device propagates that deletion; you can also remove the app's data from iCloud in your device's iCloud settings.

Children

Estora is not directed at children under 13 and does not knowingly collect their information — it collects no information from anyone.

Changes to this policy

If a future version introduces any data-related feature, we will update this policy and note the change here with a new effective date.

Contact

Questions about this policy? Email us at hello.local4a@gmail.com.