Privacy & terms.

What stays on your iPhone

Ego stores your imported photos, videos, files, and vault information in local app storage. Each vault has its own passcode and independent encryption key. Local unlocking and local recovery also require the owning iPhone’s device-only Keychain secret. Copying local vault storage and knowing the passcode or recovery key does not unlock it on another iPhone. App vault storage is excluded from automatic OS backups. Vault data stays local unless you explicitly enable the separate encrypted iCloud backup described below or export a copy yourself. There is no Ego account, Chreia-hosted vault server, cloud synchronization, or remote key-recovery service. Chreia Labs does not receive your vault contents, passcodes, encryption keys, or recovery keys through the app.

Your greeting and vault names

Onboarding asks only what to call you. A name or alias is saved as an ordinary local display preference, is not uploaded by Ego, and can be changed or cleared under Call me in Settings. It is not an account, vault name, or passcode. The greeting can appear before you unlock; ordinary preferences may be included in OS backups according to your device settings.

The locked interface does not list vault names or contents. A vault’s name appears after authentication, without an avatar. Current vault identity metadata, including names and historical appearance fields, is encrypted at rest; filenames, folder names and file details are inside the encrypted catalog. Older local indexes are encrypted when read, with each identity additionally protected under its vault key after successful authentication. Earlier plaintext copies or historical exports cannot be retroactively encrypted or erased. Technical metadata remains observable: vault existence, opaque identifiers, counts, sizes, update times, and filesystem or network activity. Ego does not promise deniability or concealment of all metadata. Historical picture data is retained securely for compatibility without a picture picker or avatar display.

No advertising or analytics

Ego does not include advertising or analytics and does not ask you to create an account. StoreKit communicates with Apple for product prices, purchases, and purchase restoration. Vault contents, passcodes, recovery keys, and device secrets are never supplied to StoreKit. Optional backup uses Apple’s private CloudKit service as described below. Apple may process App Store, service, device-backup, or diagnostic information according to your Apple settings and Apple’s privacy policy.

Optional on-device content search

Secure Smart Search is an optional Alter Ego feature, off until you enable it separately for an unlocked vault. Apple’s Vision framework processes images on your iPhone to find objects, scenes, visible text and the presence of people or faces. Supported documents use text extraction or scanned-page recognition, and videos use sampled frames. This does not identify people by name, use a large language model, or publish a Spotlight index. Recognition can miss or misread details; sampled videos, large files and unsupported formats have limited coverage. Ordinary filename and folder search remains free.

Spoken-word search is off by default and requires separate opt-in. It uses on-device SpeechAnalyzer and SpeechTranscriber with a supported language and an installed Apple model. If a model is missing, you can explicitly choose to download Apple’s language assets; no media is supplied with that request. Apple manages, shares and updates those installed assets. Unsupported devices, languages or models do not trigger cloud transcription. Ego does not capture microphone audio or send your media or recognized content to Chreia Labs or a search service.

Derived text, labels, transcripts and search settings are encrypted for that vault in local storage. They are excluded from manual and cloud backups; a restored vault needs search prepared again. Their existence, opaque identifiers, sizes and update activity remain observable. The app and iOS necessarily process readable content in memory and protected temporary files during analysis. Preparation requires Ego to stay open and the vault unlocked; locking cancels work and removes its temporary presentation. This does not guarantee instantaneous framework cancellation, erasure of every memory copy or protection on a compromised device.

Turning search or speech off stops that feature’s use but does not erase its encrypted cache. Speech text is excluded from results while its setting is off. Clear search data removes the derived records and disables search without changing originals; it remains available after Alter Ego access ends. Expiry pauses enhanced search while existing vault access and free filename search continue.

Backups you choose to export

Manually exported encrypted backups remain bound to the original iPhone. A manual backup and recovery key cannot unlock it on a replacement device; its original device-only key is also required. You choose where to save or share the encrypted file using iOS. A storage provider, including iCloud Drive if you select it, handles that manually exported file under its own terms and privacy policy. Saving a manual backup to iCloud Drive does not make it a portable iCloud backup. Keep your recovery key separately. Chreia Labs cannot replace a lost key or decrypt a vault for you.

Earlier development backups and copies used an older recovery format. Those historical copies cannot be revoked or retroactively bound to the original device; their recovery keys can still decrypt them using the older recovery method. The current app rejects those old backup restores. If you used a development version, unlock the original vault on its original iPhone and create a new device-bound manual backup or explicitly enable the separate encrypted iCloud route. Physical erasure of older copies is not guaranteed.

Optional encrypted iCloud backup

Backup is off by default. An active Alter Ego Weekly, Monthly, Annual, or Lifetime entitlement permits new uploads. You enable it separately for an unlocked vault and the current iCloud account after acknowledging that you saved its recovery key outside Ego. Purchasing Alter Ego does not turn backup on. Ego encrypts the vault name, catalog, files, thumbnails, and backup identity before uploading an archive to your private CloudKit database. Neither your passcode, device secret, nor recovery key is uploaded. Apple stores the encrypted archive and can observe the iCloud account, app/container, opaque identifiers, backup counts, sizes, update times, and service activity. Backups use your own iCloud storage quota; Alter Ego does not include an iCloud storage allowance.

A completed iCloud backup can restore on a replacement iPhone signed into the same iCloud account using its complete saved recovery key. The six-digit vault passcode alone cannot decrypt that backup. Anyone with both an encrypted backup and its recovery key can read the archived vault without the original phone. Ego supplies neither Apple nor Chreia Labs with an app decryption or escrow key. Losing both the recovery key and original-device access means we cannot recover the cloud copy.

Only the enabled, unlocked vault is backed up, while Ego is open. Keep it open until a server-confirmed completed date appears. Each vault has one current snapshot; a successful upload replaces it. This is not continuous synchronization or version history. Use one source device per vault to avoid another device replacing the latest state. Locking, leaving the app, or changing iCloud accounts cancels local work, but a request already sent to Apple may still finish. A queued attempt or an error does not establish whether a remote operation completed; refresh the backup list. Network access, free device space, iCloud availability and quota affect completion.

Turning backup off stops future uploads and keeps saved cloud copies. Deleting a local vault or uninstalling Ego does not delete its iCloud backup. To delete a cloud copy, open Settings → iCloud Backup and explicitly choose Delete; this also disables this iPhone’s automatic backup permission for that vault. Other devices or retained exports may still have copies or upload again. Downloading, restoring, and deleting existing cloud backups remain available after Alter Ego expires, without the free-vault limit blocking cloud restoration. There is no paid renewal requirement to recover those existing copies.

Originals and other copies

Importing does not delete originals. Copies may still exist in Photos, Files, other apps, or device backups. Manage those copies separately. Locking an Ego vault does not protect a copy saved outside Ego or content already viewed or shared from an unlocked vault. Previewing or sharing can create temporary decrypted files; Ego removes its temporary copies after dismissal or locking, but a recipient app may retain an exported copy.

Deleting your data

You control the vaults stored in Ego. Deleting local data does not delete saved iCloud backups, exported backups, or original files stored elsewhere. Delete saved cloud copies separately under Settings → iCloud Backup. Turning backup off alone retains them. Deletion does not guarantee physical erasure from flash storage or erase previously downloaded copies. Apple and other storage providers may retain outside copies according to their own settings and policies.

Support and changes

If you email Chreia Labs at theteam@chreialabs.com, we receive your email address and the information you choose to send. We use that correspondence to answer and resolve support or privacy requests. We retain it only as long as needed for those purposes and applicable legal obligations. You can request deletion at the same address, subject to records we are required to retain. Do not send your passcode, recovery key, or private files. This policy will be updated if Ego’s data practices change.

Ego support and recovery guidance

About these terms and the app license

These Terms of Use describe using Ego and its optional Alter Ego purchases, provided by Chreia Labs LLC. By using Ego, you agree to these terms. The iPhone application is licensed under Apple’s Standard Licensed Application End User License Agreement. These terms do not replace that agreement. The privacy policy above explains Ego’s data practices.

Ego is in development for iPhone with iOS 26 or later. It stores photos, videos, and files in separate encrypted vaults on your iPhone, with optional encrypted iCloud backup for Alter Ego. There is no Ego account, multi-device synchronization, or remote key-recovery service. Development features are not a claim of public release or completed production-cloud verification.

Your files and permitted use

You retain your rights to the content you store in Ego. Import, use, and share only content you have the right and permission to handle, and comply with applicable law. You control access to your iPhone, vault passcodes, recovery keys, and exported files.

Device binding and recovery limits

Local vault storage, local passcode recovery, and manually exported encrypted backups require the original iPhone’s device-only Keychain secret. Those copies and credentials alone cannot transfer a vault to a replacement phone. A separate, explicitly enabled and successfully completed iCloud backup can restore on a replacement iPhone signed into the same iCloud account using its saved recovery key. Keep the complete key securely outside Ego and separately from backups. Anyone possessing both the portable cloud archive and that key can decrypt the archived vault.

Do not rely on a queued, failed, or unconfirmed backup. Check the completed date before replacing or erasing a phone. Without the original device key or a completed portable cloud backup and its recovery key, Chreia Labs cannot decrypt the vault or recover its contents. A passcode, subscription, purchase receipt, or support request is not a substitute for those keys.

Earlier development backups and copies used an older recovery format. Those historical copies cannot be revoked or retroactively bound to the original device; their recovery keys can still decrypt them using the older recovery method. The current app rejects those old backup restores. Unlock the original vault on its original iPhone before making a new supported backup. Physical erasure of older copies is not guaranteed.

Originals, exports, backups, and deletion

Importing a file into Ego does not delete the original from Photos, Files, another app, or a device backup. Manage those copies separately. An unencrypted export or a file shared from an unlocked vault leaves Ego’s protection; a receiving app or person may retain it. You choose where manually exported backups and files are saved or shared, and any outside provider’s terms and privacy policy apply to its copy.

Optional iCloud backup stores one current encrypted snapshot per enabled vault using your own iCloud quota. It updates while the vault is unlocked and Ego is open; it is not continuous synchronization, version history, or a guarantee of uninterrupted delivery. A later upload can replace the previous snapshot, including from another opted-in device. Use one source device per vault. Turning backup off retains the cloud copy; deleting a local vault or uninstalling Ego does not delete cloud copies. Explicit cloud deletion disables this iPhone’s automatic permission first, but does not revoke downloaded copies or another device’s upload permission. An already submitted operation may finish after cancellation.

Keep independent copies of important files in a location and form you consider secure. Review the recovery limits before deleting a vault, removing app data, or replacing your device. Encryption does not conceal technical sizes, counts, identifiers or activity and cannot guarantee protection on a compromised device. Deletion does not guarantee physical erasure from flash storage.

Alter Ego purchases

Ego allows one free vault. Alter Ego permits additional vaults, new optional encrypted iCloud backup uploads and optional Secure Smart Search through weekly, monthly, or annual auto-renewable subscriptions, or a one-time Lifetime purchase. Search and backup require separate per-vault opt-in; purchasing does not enable either. Spoken-word analysis has a separate default-off setting and requires a supported on-device model. The purchase screen shows the applicable localized price, billing period, and purchase terms before you confirm with Apple. No purchase is required to unlock, edit, export, or delete an existing vault.

A subscription provides Alter Ego access during its eligible period. Lifetime unlocks the same Alter Ego benefits without a recurring subscription charge. Buying Lifetime does not cancel an existing subscription; cancel it with Apple to stop renewals. All four options use your own iCloud quota and do not include an iCloud storage allowance, a Chreia-hosted storage service, or recovery without the required key. Restoring a purchase restores an eligible entitlement; it does not restore vault files or device keys.

If Alter Ego access ends, your existing vaults remain unlockable, editable, exportable, and deletable. New cloud uploads and enhanced content search stop; free filename search and clearing derived search data remain available. Downloading, restoring, and deleting existing iCloud backups remain available without a current plan, and cloud restoration is not blocked by the free-vault limit. Creating new vaults and restoring additional device-bound manual backups remain subject to the free-vault limit until Alter Ego access is active again.

Apple billing, cancellation, restoration, and refunds

Apple processes payments through your Apple Account. Subscriptions renew automatically unless canceled at least 24 hours before the current period ends; Apple charges for renewal within 24 hours before that period ends, subject to the terms Apple presents at purchase. Manage or cancel subscriptions in iOS Settings → your name → Subscriptions, or use Apple’s subscription settings. Deleting Ego or a vault does not cancel a subscription. Cancellation generally takes effect at the end of the paid period.

Use Restore Purchases in Alter Ego to restore eligible purchases for your Apple Account. Apple handles refund requests under its policies and applicable law; see Apple’s refund request service. Mandatory consumer rights and remedies remain unaffected.

Support and updates

See Ego support for current guidance. For product and privacy questions, contact theteam@chreialabs.com. Never send your passcode, recovery key, device key, or private files.

Updated terms will appear on this page with a revised effective date. Material changes will receive additional notice or consent where required by applicable law. Changes to paid features remain subject to the purchase terms and applicable consumer protections.