1. Overview

Depositt ("the App") is developed and published by Kynoss Studios ("we," "us," or "our"). Depositt is a rental condition-documentation app for iPhone and iPad (iOS 26 and iPadOS 26 and later) that helps a renter protect their security deposit. You walk through your rental room by room under a numbered room legend, capture in-app photos that Depositt stamps with the date and time (and, optionally, your coarse location), and — at move-out — re-shoot each move-in photo with an on-screen guide to produce side-by-side before/after comparisons. The result is a dated PDF report you can send your landlord and keep as evidence.

This Privacy Policy explains what data Depositt accesses, how that data is processed, and your rights regarding your information. We are committed to transparency and to protecting your privacy.

Depositt has no Kynoss-operated servers and no user account. Your data lives on your iPhone and, through Apple's CloudKit, in your own private iCloud account so it can sync across your devices. We have no mechanism to collect, receive, view, or store your personal data — we cannot see what is in your private iCloud. The reports Depositt produces stay under your control.

2. Camera Access

• Camera frames are processed only when you explicitly tap the shutter to capture a photo. Live preview frames are not recorded.
• Captured photos are saved into the active report on your device (and synced to your own private iCloud — see "Data Storage, iCloud Sync & On-Device Processing"). Each in-app photo is stamped with Depositt's own capture date and time so the report carries its own dating; Depositt does not write photos back to your iOS Photos library.
• Camera access is requested via the iOS permission prompt the first time you tap Capture. You can revoke access at any time in Settings > Depositt.
• Camera frames are never transmitted off your device, never copied to any server, and never shared with any third party.

3. Photo Library Access

How Library Photos Are Used

• Selected photos are copied into the active report (on your device and your private iCloud) so removing the photo from your Photos library doesn't break your report.
• Imported photos are clearly marked "date unverified" in the report, because Depositt cannot vouch for when a library photo was actually taken — only photos captured inside Depositt carry its trusted date stamp.
• No photo data is ever transmitted to Kynoss or any third party.

The PHPicker pattern means Depositt does NOT request full photo library access (PHPhotoLibrary.requestAuthorization); only individual photos you pick are revealed to the app. This is the most privacy-preserving photo-selection pattern Apple offers.

4. Location Services

• Depositt uses Apple's CoreLocation framework with "When In Use" authorization and reduced (approximate) accuracy: enough to show the area a photo was taken in, not the front door. Location is never requested in the background.
• Depositt stamps the raw coordinates only. It does not reverse-geocode to a street address and does not contact any geocoding service — nothing about your location leaves your device or your own private iCloud.
• Coordinates are saved with each photo, on your device and in your own private iCloud, and are printed in the PDF report you create. They are not transmitted to any Kynoss server (we don't have one) and not shared with any third party.
• You can decline location access entirely; reports work normally, just without the coordinate stamp.
• You can revoke location access at any time in Settings > Depositt > Location.

5. On-Device Intelligence (Apple Foundation Models)

• The model runs locally on your iPhone via Apple Intelligence. Your note is not sent to Kynoss, to OpenAI, or to any third-party AI service.
• Depositt only ever passes the model the text you typed — it does not send your photos, and it does not ask the model to recall outside facts.
• The feature is optional and only appears on supported devices where Apple Intelligence is available. If it isn't available, you simply edit captions yourself.

6. Data Storage, iCloud Sync & On-Device Processing

Properties, walkthroughs, rooms, photos, and reports are stored on your device using Apple's SwiftData framework and synced through Apple's CloudKit private database to your own iCloud account, so your reports are available across the devices signed into your Apple ID. This is the same private-iCloud mechanism Apple provides to all apps:

• It is your iCloud, not ours. Data in the CloudKit private database is accessible only to your Apple ID. Kynoss Studios has no access to it and no ability to read, export, or delete it.
• There is no CloudKit public database, no shared records, and no cross-renter or landlord-visible data. Nothing you capture is ever shared with another user.
• If you sign out of iCloud or disable iCloud for Depositt, the app keeps working with your data stored locally on that device.

This data is protected by:

• iOS Data Protection (encrypted at rest, tied to your device passcode)
• Apple's iCloud encryption in transit and at rest for the private database
• App sandboxing (only Depositt can access its own data store)

What Depositt Stores

Depositt does not use:

• Any server or cloud storage of ours. The only cloud involved is your own private iCloud (and iCloud Backup, if you've turned it on in iOS)
• Any third-party SDKs, frameworks, or libraries (Depositt depends only on Apple's first-party frameworks)
• Analytics services (no Firebase, no Mixpanel, no Amplitude, etc.)
• Advertising SDKs or ad networks
• Crash reporting services
• Any form of user tracking or fingerprinting

7. Data Retention & Deletion

Retention Policy

• Properties, walkthroughs, rooms, photos, and reports are retained on your device and your private iCloud until you delete them or delete the app.
• Generated PDFs that you've shared via iOS share sheet are subject to whichever destination's retention rules apply (your email provider, the recipient's device, etc.) — not Depositt's.

Deletion

• Delete one item: Swipe a property or a room to delete it, or open a photo and tap Delete. What you delete is permanently removed, along with the photos inside it.
• Delete everything: In Depositt, open Settings and tap Delete All Data. Every property, walkthrough, photo and report is removed from this device and from your iCloud on all your devices.
• Delete the app: Deleting Depositt from your device permanently removes all local reports, photos, and PDFs. To remove the iCloud copy, delete the items (or the app's iCloud data) from a device signed into your Apple ID. There is no Kynoss server-side data to delete and no account to close.
• If you want to preserve reports before deleting the app, export them as PDFs to Files or iCloud Drive first.

8. Data Sharing & Third Parties

• We do not sell your data.
• We do not share your data with third parties.
• We do not transmit your data off your device, except that your reports sync to your own private iCloud (Apple's CloudKit) and Apple's StoreKit 2 verifies the one optional purchase. Both are handled by Apple under Apple's own privacy policy; Kynoss receives no personal data from either — only a sync we cannot read and a purchase entitlement.
• We do not use third-party SDKs that could collect data.
• We do not serve advertisements.
• We do not engage in data mining or user profiling.
• We do not share data with parent companies, subsidiaries, or related entities (Kynoss Studios is an independent sole developer).

When you share a PDF via iOS share sheet, the destination you choose (Mail, Messages, AirDrop, third-party app) handles the file under its own privacy policy. Depositt has no involvement in or visibility into what happens after the share.

9. In-App Purchases

Depositt is free to use — you can document your rental, build your room legend, capture before/after photos, and preview your report at no charge. There is one optional purchase:

• Depositt Pro — a single, one-time non-consumable purchase ($7.99). No subscription, no recurring charge, no free trial. Pro unlocks exporting the move-out before & after report and removes the watermark from exported PDFs.

Privacy of Purchases

• The purchase is processed by Apple via StoreKit 2, not by Kynoss Studios. Apple's privacy policy and the App Store Review Guidelines govern the transaction.
• Depositt receives only an entitlement signal from Apple (whether you own Depositt Pro). We do not see your name, email, payment method, or any other personal information.
• To restore your purchase on a new device, tap Restore Purchases on the paywall.

10. Data Security

Depositt relies on Apple's built-in security infrastructure to protect your data:

• Encryption at rest: All local data is protected by iOS Data Protection, which encrypts data using keys tied to your device passcode.
• App sandboxing: iOS prevents other apps from accessing Depositt's data store.
• Minimal network exposure: Depositt makes no Kynoss-server network requests. The only network activity is Apple's iCloud sync (your private CloudKit database) and Apple's StoreKit 2 (purchase verification), both governed by Apple.
• No accounts: There are no credentials to steal, no passwords to breach, and no accounts to compromise.

11. Children's Privacy (COPPA)

Depositt is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13.

Because Depositt does not collect, transmit, or store personal information on any server, and because all data remains solely on the user's device, Depositt does not create the data collection risks that COPPA is designed to address. Nonetheless:

• Depositt does not collect personal information from any user, including children.
• Depositt does not require or support account creation.
• Depositt contains no advertising or social features.
• Depositt does not transmit any data to Kynoss Studios or any third party.

If you are a parent or guardian and have questions about this policy, please contact us at support@kynossstudios.com.

12. Your Rights Under GDPR (European Economic Area)

If you are located in the European Economic Area (EEA), the General Data Protection Regulation (GDPR) provides you with specific rights regarding your personal data. We respect these rights, even though Depositt's on-device architecture means we do not act as a data controller or processor of your personal data in the traditional sense — because your data never reaches us.

Legal Basis for Processing

To the extent any on-device processing constitutes "processing" under the GDPR, the legal basis is:

• Consent: You explicitly grant permission for camera, photo library, and location access through the iOS permission prompts. You may withdraw consent at any time via iOS Settings.
• Legitimate interest: Processing your data on your own device to provide the app's functionality directly to you.

Your Rights

• Right of access: Your data is stored on your device (and in your private iCloud, if iCloud is on) and accessible to you at all times within the app.
• Right to rectification: You can edit any property, room, photo, or caption directly in the app.
• Right to erasure: You can delete items individually, use Settings > Delete All Data, or delete the app.
• Right to restrict processing: You can revoke camera, photo library, or location permission at any time without affecting other app functionality.
• Right to data portability: Export any report as a PDF and save to Files, iCloud Drive, or share to any destination.
• Right to object: You can stop all data processing by revoking permissions or deleting the app.

Data Transfers

Depositt does not transfer personal data to Kynoss. The only data leaving your device is your private iCloud sync and StoreKit 2 purchase verification — both under Apple's control, disclosed in section 8, and governed by Apple's privacy policy.

Data Protection Officer

Due to the nature of our data processing (entirely on-device, no data collection), we are not required to appoint a Data Protection Officer. For any privacy-related inquiries, please contact us at support@kynossstudios.com.

13. Your Rights Under CCPA/CPRA (California)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights.

Information We Collect

Under CCPA/CPRA definitions, Depositt processes the following categories of information on your device only:

• Photos and visual content you capture or import into a report
• Geolocation data attached to photos at capture time (if you grant location permission)

However, because all processing occurs on your device and we never collect, receive, or access this information, Kynoss Studios does not "collect" personal information as defined by the CCPA/CPRA.

Your Rights

• Right to know: This Privacy Policy describes all data the app processes. We do not collect additional data beyond what is described here.
• Right to delete: Delete items individually, use Settings > Delete All Data, or delete the app.
• Right to opt out of sale: We do not sell your personal information. We never have and never will.
• Right to opt out of sharing: We do not share your personal information with third parties for cross-context behavioral advertising or any other purpose.
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.

"Do Not Sell or Share My Personal Information"

Depositt does not sell or share personal information. Because no data is transmitted from your device to us, there is no sale or sharing to opt out of. We fully comply with the CCPA/CPRA without requiring any user action.

14. Apple Platform Disclosures

In compliance with Apple's App Store Review Guidelines and platform requirements:

Camera, PhotoKit, and CoreLocation

• Depositt uses the camera (AVFoundation) to capture photos directly into reports.
• Depositt uses PhotoKit's PHPicker to let you import individual photos from your library — Depositt does not request full photo library access.
• Depositt uses CoreLocation ("When In Use", reduced accuracy) to optionally stamp coarse GPS coordinates onto a photo; it does not reverse-geocode, and the coordinates stay with the photo on your device and in your own private iCloud.
• None of these inputs are transmitted off your device by Depositt.

StoreKit 2

• Depositt uses StoreKit 2 to offer one optional non-consumable purchase (Depositt Pro, $7.99), processed by Apple. No subscriptions.
• Apple's Standard EULA governs the purchase relationship.

Required Reason APIs

Depositt uses only Apple's first-party frameworks. Two everyday Apple features it relies on are on Apple's "required reason" list: saving simple settings on your device (for example, whether you've seen the welcome screens) and checking how much free storage you have before saving a photo. Depositt declares both in its privacy manifest and uses them for nothing else.

App Tracking Transparency

Depositt does not track users across apps or websites owned by other companies. The App Tracking Transparency framework is not used because no tracking occurs.

App Privacy Nutrition Label

Depositt's App Store privacy nutrition label accurately reflects that the app does not collect data linked to user identity and does not track users.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in the app's functionality or legal requirements. When we make changes:

• The "Last Updated" date at the top of this page will be revised.
• Material changes will be communicated through the app or its App Store listing.
• Continued use of Depositt after changes constitutes acceptance of the updated policy.

We encourage you to review this policy periodically.

16. Contact Us

If you have questions about this Privacy Policy, your privacy rights, or Depositt's data practices, please contact us:

• Email: support@kynossstudios.com
• Developer: Kynoss Studios
• Support Page: Depositt Support

We will respond to privacy inquiries within 30 days.