masterfile
Terms & Privacy
v1.5 — In-app
purchase wired through Apple StoreKit. Added
disclosures for local notifications, home-screen widgets, and the on-device
Scratch parser.
This document covers both the Privacy Policy (how I
handle information about your use of the App) and the Terms of Service (the
rules that govern your use of the App). They are presented together for convenience,
but each part stands on its own and may be cited separately.
Contents
Part I · Privacy Policy · fourteen sections
Part II · Terms of Service · eighteen sections
This Privacy Policy describes how I, Louis Cada (referred
to throughout this document as "the developer," "I,"
"me," or "my"), handle information when you use the masterfile iOS application (the "App"). masterfile is a single-user productivity app built around five
modules — Scratch, Vault, Budget, Notes+, and Kanban — that runs entirely on
your device. I have designed the App so that the content you create inside it
stays on your device. I never receive, store, or have access to the notes,
vault entries, budget data, kanban boards, or attachments you create.
However, I do collect a small amount of anonymized,
aggregated information about how the App performs and which features are used,
so I can fix problems and improve the App over time. The details of what I collect
(and what I deliberately do not collect) are in Sections 2 and 3 below.
Everything you write, save, or store inside masterfile stays on your device or in your personal iCloud
storage, depending on your iCloud Drive settings. I do not run servers that
hold your content. I do not have an account system — there is nothing to sign
up for and nothing to sign in to. I do not show advertising, and I do not sell
information about you to anyone.
I do collect anonymized usage and performance metrics
through Apple's built-in analytics (App Store Connect Analytics and MetricKit) and through any feedback you send me directly.
These tell me things like "how many people opened the editor today"
or "the app crashed for 0.2% of users on iOS 18.4" — not who you are
or what you wrote.
The masterfile unlock is a
one-time in-app purchase, processed by Apple through StoreKit.
I never see your payment information.
I do not collect, store, or have access to:
There is no advertising SDK and
no third-party tracking SDK in the App. The contents of your notes and vault
never leave your device through the App.
To make the App better — to find crashes, measure
performance, understand which features people actually use,
and decide what to build next — I receive anonymized, aggregated metrics from
four sources. None of these sources include the contents of your notes, vault,
budget, kanban, or attachments. None of them identify you as a person.
Apple provides developers with aggregated, anonymized
analytics through App Store Connect. This includes app store impressions,
installs, sessions, retention, active devices, the country your device reports,
your language, and your iOS version. The data is reported only in aggregate — I
cannot see any single user's behavior, and I do not receive any device
identifier I could use to contact you. This service is provided by Apple, not
by me, and is governed by Apple's privacy policy.
You can opt out at any time by going to iOS Settings →
Privacy & Security → Analytics & Improvements and turning off
"Share With App Developers." When this is
off, no App Store Connect Analytics data is sent from your device to me.
MetricKit is an Apple
framework that gathers performance and stability metrics on your device and
delivers them to me as a single anonymized daily payload. Examples include app
launch time, CPU and memory use, energy consumption, animation hitch rate, hang
reports, and crash diagnostics. The data is generated and aggregated on your
device by iOS before it is sent, and it contains no content, no personal
identifiers, and nothing that ties one daily payload to another from the same
device.
MetricKit is controlled by
the same iOS setting as App Store Connect Analytics: Settings → Privacy &
Security → Analytics & Improvements → Share With
App Developers.
If you contact me by email, on social media, or through
any other channel you choose, I receive whatever information you choose to
share — typically your email address or handle, and the contents of your
message. I use this information only to respond to your inquiry and to fix problems
you report. I keep support correspondence only as long as needed to resolve the
issue and any follow-up.
All content you create inside the App is written to your
device's local file system, inside the App's sandboxed Documents directory.
Specifically:
Every JSON file is written using iOS's atomic-write API
with NSFileProtectionComplete, which means the file
is encrypted at rest by iOS while your device is locked.
Vault stores its sensitive secrets separately. Passwords,
card numbers, CVVs, and PINs are written to the iOS Keychain rather than to the
JSON file. The Keychain entries use the kSecAttrAccessibleWhenUnlockedThisDeviceOnly
access class, which means:
When you delete the App from your device, all of the App's local data (the JSON files, the attachment
binaries, the Keychain entries, and the UserDefaults
preferences) is removed by the operating system. There is nothing on my side to
delete because nothing is on my side.
In addition to storage, the App performs on-device
processing of your content for certain features. The Scratch capture surface,
including the Promote feature that routes a quick note to Notes+, Vault,
Budget, or Kanban, runs an on-device regular-expression parser to detect things
like amounts, currencies, dates, card numbers, and email addresses. The parser
does not transmit your scratch text to any server, does not use any
machine-learning model, and does not "learn" from your input. It runs
entirely inside the App process on your device. The same is true of Apple's
on-device frameworks the App uses for related features — VisionKit
(document scanning), AVFoundation (voice memos), PDFKit (PDF viewing), and LocalAuthentication
(biometric checks). None of these transmit your content off-device.
The App requests the following iOS permissions only when
you actively use a feature that needs them. None of these permissions cause the
contents of your notes or vault to leave your device.
Used to unlock Vault, to confirm locking a sensitive
note, and to open a locked note. The biometric check is performed by the
operating system. The App never sees your face data, your fingerprint data, or
any biometric template. The App receives only a yes-or-no result from iOS.
Used by the Scan Document feature in Notes+ to capture a printed
document and save it as a PDF attachment to a note. The captured image is
processed entirely on your device by Apple's VisionKit
document scanner and saved into your note's local attachment folder. The image
is not transmitted to me or to any third party.
Used when you attach a photo or a video from your library
to a note. The picked file is copied into your note's local attachment folder.
The App does not access photos you do not explicitly pick, and the file is not
transmitted off-device.
Used when you record a voice memo as an attachment to a
note. The recording is saved as a local audio file inside your note's
attachment folder. It is not transmitted off-device.
The App requests permission to send local notifications
through Apple's UNUserNotificationCenter framework.
When you grant permission, all notifications are scheduled and delivered
entirely on your device. There is no push-notification server, no APNS registration
on my side, and no remote payload. Notification text (for example, "Review
your password for [label]," "Budget threshold reached," or
"Your note is moving to trash in 3 days") is composed at scheduling
time from data already stored on your device and is delivered by iOS even if
your device has no internet connection. You can fine-tune which categories of
notifications fire from inside the App's Notifications screen, and you can
revoke notification permission entirely in iOS Settings → masterfile
→ Notifications.
You can revoke any of these permissions at any time in
iOS Settings → masterfile.
masterfile relies on Apple's
operating system services, including:
Apple's privacy practices for these services are governed
by Apple's privacy policy.
When masterfile offers paid
features, those purchases are processed through Apple's StoreKit.
The payment transaction takes place between you and Apple. I do not collect,
see, or store your credit card information, your Apple ID, your billing
address, or any other payment detail. I receive only the unlock entitlement
from Apple, which I record locally on your device so that you do not have to
pay again.
masterfile does not integrate
with any third-party advertising network, attribution provider,
push-notification service, or cloud backend. The App does not use embedded web
views to load external content. The App does not maintain a server of its own.
Under normal operation, the App may make outbound network
requests in the following situations:
I do not perform background fetches, background uploads,
push notifications, silent network calls, or any "phone-home"
activity beyond what is described above.
The App's home-screen and Lock Screen widgets read
content from a shared App Group container on your device — a private storage
area that the App writes to and the Widget extension reads from. App Groups are
an iOS storage mechanism and are entirely local; they do not involve any
network call. Widget timelines are refreshed by iOS on its own schedule and by
the App after relevant data changes (for example, after a Vault save or after you
toggle the unlock). Widgets respect Vault's locked state and never display
secret values; paid widgets show a "locked" placeholder until the
Unlock is purchased.
masterfile is a
general-audience productivity app. It is not directed at children under 13 (or
under the relevant age of digital consent in your jurisdiction, which may be
higher). I do not knowingly collect personal information from children. The App
stores no personal information of any kind on my side; the aggregated analytics
described in Section 3 cannot be used to identify a child or any other user. To
remove the App's data from a device, uninstall the App.
If iCloud Drive or iCloud Keychain is enabled on your
device, your content may be transmitted to and stored on Apple's iCloud
servers, which may be located in a different country
from where you reside. This transfer is governed by Apple's iCloud privacy policy
and terms, not by this policy. If iCloud is disabled, no international transfer
of your content is caused by your use of the App. Anonymized analytics may be
transmitted to servers operated by Apple (typically in the United States and
Europe). These transfers are governed by the privacy policies of those
providers and by the standard contractual clauses or other safeguards they put
in place. Any data movement that may occur because of Apple services you triggered
(such as an App Store purchase or an iCloud Device Backup) is governed by
Apple's privacy policy and your Apple ID region settings.
If you enable iCloud Backup or back up your iPhone or
iPad to a computer, your device backup will include the App's local files and
attachments as part of the standard iOS device backup. That backup is held by
Apple (for iCloud) or by you (for local computer backups). I do not have access
to those backups. Vault secrets stored in the iOS Keychain are excluded from
iCloud Backup by their access class (ThisDeviceOnly)
and will not be included in an iCloud Device Backup.
I do not retain the contents of your notes, vault,
budget, or kanban, because I never receive them. Your content lives only on
your device. You control its retention:
Anonymized analytics events sent to Apple are retained by those providers
according to their own retention policies, which you can review at the URLs in
Section 6. Any support correspondence you send me is retained only as long as
needed to resolve the issue and any follow-up.
I have designed masterfile
around the principle that the safest data is data that never leaves your
device. To that end:
No security measure is perfect. You are responsible for
the security of your device itself — keep iOS up to date, use a strong device
passcode, and enable biometric protection.
You can exercise full control over the App's data
directly on your device:
If you are in a jurisdiction (such as the European
Economic Area, the United Kingdom, or California) whose privacy laws provide
additional rights — to access, correct, port, delete, or restrict processing — those
rights still apply to any information I or my analytics providers hold about
you. The information I hold is limited to what is described in Section 3 and
Section 14. Please contact me to exercise any such right; I will respond within
a reasonable time and as required by applicable law.
If you have questions about this Privacy Policy or about
how masterfile handles data, please contact me at:
Email: support.masterfile@gmail.com
These Terms of Service (the "Terms") govern
your access to and use of the masterfile iOS
application (the "App"). The App is made and provided by Louis Cada
(referred to in this document as "the developer," "I,"
"me," or "my"). By downloading, installing, or using the
App, you agree to be bound by these Terms. If you do not agree to these Terms,
please do not use the App.
Please read these Terms together with the Privacy Policy
in Part I above, which is incorporated by reference.
You must be at least 13 years old (or the applicable age
of digital consent in your jurisdiction, which may be higher) to use the App.
By using the App, you represent that you meet this requirement. If you are
using the App on behalf of an organization, you represent that you have the
authority to bind that organization to these Terms.
Subject to your compliance with these Terms, I grant you
a personal, non-exclusive, non-transferable, non-sublicensable, revocable license
to download the App from the Apple App Store and use it on Apple-branded
devices that you own or control, as permitted by Apple's App Store Terms of
Service and the Apple Media Services Terms and Conditions.
This license does not grant you the right to:
Everything you create in the App is stored on your
device. If iCloud Drive is enabled, the App's data files sync to your personal
iCloud storage via Apple's iCloud Documents container — I do not host or have access
to those files. Everything you create in the App (your notes, folders, tags,
attachments, vault entries, budget data, kanban boards and cards, scratch text,
color labels, and any other content collectively, "Your Content") is
stored on your device. I do not host, receive, or have access to Your Content.
The anonymized analytics described in Part I, Section 3 are limited to usage
and performance metrics; they do not include Your Content.
You retain all rights you have in Your Content. Because I
do not receive Your Content, I make no claim of ownership over it. I do not
grant myself any license to use, display, modify, or distribute Your Content —
not within the App, and not anywhere else.
You are solely responsible for Your Content. You must
ensure that Your Content does not violate any law and does not infringe anyone
else's rights.
Because Your Content is stored only on your device, you
are responsible for backing it up. The available options are:
I am not able to recover lost
data on your behalf. If you delete the App from your device without first
backing it up, the App's data — including Vault secrets stored in the iOS
Keychain — may be permanently lost.
If you have iCloud Drive enabled, the App's data syncs automatically
across your devices via iCloud, which serves as an additional layer of
redundancy. Vault secrets sync via iCloud Keychain when that is also enabled.
Note that iCloud sync is not a substitute for a full device backup —
uninstalling the App removes local data, and iCloud Drive file availability
depends on your iCloud storage quota and Apple's servers.
Vault stores credentials, card numbers, PINs, and other sensitive
material locally on your device, using the iOS Keychain for the most sensitive
fields. I have designed Vault around the same patterns Apple and major password
managers use, but you should understand the following:
Custom fields you add to a Vault entry are stored in plain
JSON on your device alongside the entry's metadata, even when marked
"Secure." The "Secure" flag controls only the show/hide
toggle in the UI — not the storage class. If a value is so sensitive that it
requires hardware-protected storage, create a separate Vault entry of kind
"Key" for it, where the primary secret is stored in the iOS Keychain.
You agree not to use the App to:
I cannot police Your Content because I cannot see it. The
App is provided to you for your private use, and you assume the legal and ethical
responsibility for what you choose to store inside it.
The App is free to download and includes a free tier with
per-module limits (20 Notes, 2 Folders, 5 Vault entries, 2 Kanban boards, 3
Budget accounts, 5 Budget categories, plus a curated selection of free
widgets). The masterfile unlock — a one-time in-app
purchase processed by Apple through StoreKit — lifts
every per-module limit, enables event-based smart notifications, and unlocks
every widget shipped with the App.
If you make an in-app purchase:
You acknowledge that these Terms are entered into between
you and me, and not with Apple. Apple is not responsible for the App or its contents.
To the extent these Terms differ from the Apple App Store Terms of Service, the
Apple App Store Terms control the parties' relationship with Apple. If the App
fails to conform to any applicable warranty, you may notify Apple, and Apple
may refund the purchase price (if any) to you; to the maximum extent permitted
by applicable law, Apple has no other warranty obligation whatsoever with
respect to the App.
You and I acknowledge that Apple and its subsidiaries are
third-party beneficiaries of these Terms and that, upon your acceptance, Apple
has the right (and is deemed to have accepted the right) to enforce these Terms
against you as a third-party beneficiary.
I may release updates to the App from time to time
through the App Store. Updates may add features, change features, remove
features, and fix bugs. Some updates may require a minimum iOS version. I am
not obligated to maintain support for older versions of iOS indefinitely.
The App, including its name, logo, illustrations, copy,
design, source code, and visual style, is owned by me and is protected by
copyright, trademark, and other laws. Except for the limited license granted in
Section 2, these Terms do not grant you any right, title, or interest in the
App.
The App is provided "as is" and "as
available" without any warranty of any kind, express, implied, or
statutory. To the fullest extent permitted by applicable law, I disclaim all warranties,
including without limitation the implied warranties of merchantability, fitness
for a particular purpose, accuracy, non-infringement, quiet enjoyment, and
title, as well as any warranties arising from course of dealing, course of
performance, or usage of trade.
I do not warrant that the App will be uninterrupted,
error-free, or free from viruses or other harmful components. I do not warrant
that any data you store in the App will be preserved against accidental loss caused
by you, by your device, by iOS, by another app on your device, or by hardware
failure. You assume all risk for your use of the App.
To the fullest extent permitted by applicable law, in no
event will I or my suppliers be liable for any indirect, incidental, special,
consequential, exemplary, or punitive damages, or for any loss of data, loss of
profits, loss of revenue, loss of goodwill, or loss of use, arising out of or relating
to your use of, or inability to use, the App — even if I have been advised of
the possibility of such damages.
My total cumulative liability arising out of or relating
to these Terms or the App, whether in contract, tort, or otherwise, will not
exceed the greater of (a) the amount you paid for the App in the twelve (12)
months preceding the claim, or (b) five U.S. dollars (USD $5.00).
Some jurisdictions do not allow the exclusion of certain warranties
or limitations of certain damages. In those jurisdictions, the disclaimers and
limitations above apply only to the extent permitted by law.
You agree to defend, indemnify, and hold me harmless from
and against any third-party claim, liability, damage, loss, and expense
(including reasonable attorneys' fees) arising out of or relating to (a) your
use of the App, (b) Your Content, or (c) your breach of these Terms or violation
of any law or third-party right. I reserve the right to assume the exclusive
defense and control of any matter otherwise subject to indemnification by you.
You may stop using the App at any time. To terminate
these Terms with respect to your use, delete the App from your device. I may
suspend or terminate your access to the App at any time, with or without
notice, for any reason, including if I reasonably believe you have violated these
Terms or applicable law. Sections 3, 4, 5, 10, 11, 12, 13, 14, 16, 17, and 18
will survive any termination of these Terms.
I may revise these Terms from time to time. When I do, I
will update the "Last Updated" date in the masthead and post the new
version at the URL where these Terms are hosted. Material changes will be
reasonably highlighted (for example, with an in-app notice). Your continued use
of the App after the new Terms take effect constitutes your acceptance of them.
If you do not agree to the revised Terms, you must stop using the App and
delete it from your device.
These Terms are governed by and construed in accordance
with the laws of the Republic of the Philippines, without regard to its
conflict-of-laws principles. The United Nations Convention on Contracts for the
International Sale of Goods does not apply to these Terms. Any dispute arising out
of or relating to these Terms or the App will be brought exclusively in the
courts located in Quezon City, Philippines, and you and I consent to personal
jurisdiction and venue there.
Nothing in this Section will deprive you of any mandatory
protection under the law of the country in which you reside that cannot
lawfully be excluded by contract.
These Terms, together with the Privacy Policy in Part I, constitute
the entire agreement between you and me regarding the App and supersede all
prior and contemporaneous understandings on the subject.
If any provision of these Terms is held to be
unenforceable, that provision will be modified to reflect the parties'
intention as closely as possible, and the remaining provisions will remain in
full force and effect.
My failure to enforce any right or provision of these Terms
will not be considered a waiver of that right or provision.
You may not assign or transfer these Terms or any rights
under them without my prior written consent. I may assign these Terms freely.
Any prohibited assignment will be void.
These Terms do not create any third-party beneficiary
rights, except as expressly stated in Section 8 with respect to Apple.
I will not be liable for any failure or delay in performing
my obligations under these Terms when caused by events beyond my reasonable
control, including acts of God, pandemic, government action, war, civil unrest,
labor disputes, power outages, internet outages, or failures of third-party
services.
I may provide notices to you within the App or at any
contact method you have provided. You may contact me using the information in
Section 18.
If you have questions about these Terms, please contact
me at:
Email: support.masterfile@gmail.com
masterfile is an
independent application. Apple is not a sponsor or party to this Privacy Policy
or these Terms, except as expressly stated in Part II, Section 8.