Privacy / ownership
Employees cannot
open a vault.
That is a design constraint, not a slogan. Anchor is a native iOS app. The personal binder and the next-action ranker do not need a vendor server to function.
Offline-first
The vault, on-device search, and the ranker work with airplane mode on. Capture still lands. Siri answers while unlocked. The Lock Screen widget reads a redacted snapshot file, not the vault key. After a reboot, the widget is empty until you unlock.
Where inventory lives
Records live in an encrypted on-device database (SQLCipher). Document blobs are encrypted. The vault container is excluded from iCloud / Finder backup. Restore is a proximity wrap from a device you already have, or the 24-word recovery key. There is no third path.
- Local-only is free forever and useful without an account.
- Secrets (SSN, full PAN, TOTP seeds) are exact-reveal only. They are never in full-text search.
- Spotlight is not indexed. That would leak the inventory.
- Last-90-day blobs stay resident. Older blobs evict and re-download on Wi-Fi.
Key hierarchy
A 24-word BIP-39 recovery key wraps the vault key. The vault key lives in the Secure Enclave as WhenUnlockedThisDeviceOnly. Collection keys sit under that. An emergency key is not the vault key. Web designees wrap collection keys to WebAuthn — never the vault key, and never by pasting the recovery phrase into a browser.
Sync is ciphertext
If you turn sync on, the server stores encrypted operations and padded blobs. It can see device IDs, bucketed sizes, stream IDs, and emergency request events. It cannot decrypt the vault. CloudKit is not the sync fabric.
Sync cannot turn on until the recovery kit is confirmed. Smash the only device without those words and the vault is gone. The app says that out loud.
Family and emergency
One vault per adult. Grants wrap collection keys to a named person. UI filters are not access control. Therapy notes are never on the caregiver template. Kids’ SSNs may exist as secrets in the owner vault; they are never in grant templates or packet defaults.
MVP emergency is a local sealed PDF / paper QR you can physically hand someone. No server in that path. v1 may add dual-control release. There is no dead-man’s switch and no fake / duress vault. A coerced owner can be forced to grant; fast revoke is the mitigation, and the copy says so.
Connectors
Camera, Files, the share sheet, and read-only calendar are the MVP path. Password import is optional. Mail (Gmail gmail.readonly, Microsoft Graph) is after publisher review / CASA — not session 1. iCloud Mail is unsupported. Finance aggregation is out of MVP. Illegal scraping of bank, insurance, or government portals is never the product.
Health data is consumer-held through v1. Anchor is not a HIPAA covered entity in MVP. Do not read that as “not a health app” — it still stores what you put in.
What we never do
- No social graph, feeds, streaks, gamification, or ads.
- No training on vault contents.
- No remote edits to ranker weights.
- Support sees routing email, a device list, and a support code. Not plaintext.
What we do not collect on this site
This marketing site is static. The waitlist form sends App name, phone OS, and email to admin@snapcollectibles.com so we can follow up. No analytics SDK is bundled. No vault data ever touches this site.