Privacy Policy
Custen is a private delayed-access service. It is designed for encrypted documents shared by a vault master with recipients they choose.
Server choice
The Custen app does not contain a default server address. A vault master configures the server used by their vault, and enrollment or recovery material carries that server binding to other devices. This policy describes the official Custen app and the official Custen server. A vault configured to use a server operated by somebody else is also subject to that operator’s privacy terms.
Information Custen processes
Custen does not require an account and does not ask for a name, email address, telephone number, contacts, location, advertising identifier, or payment details.
To provide the service, a configured Custen server stores:
- Random opaque identifiers for vaults, devices, documents, grants, and requests
- Device public keys and Apple App Attest security records
- An Apple Push Notification service token while a device remains eligible for security notifications
- Encrypted vault and document labels, encrypted key envelopes, and encrypted document contents
- Ciphertext sizes, security deadlines, protocol state, and security audit events
The server does not receive recovery-kit secrets, plaintext document contents, plaintext private labels, document decryption keys, biometric templates, Face ID results, or the device passcode.
Why the information is used
The information is used only to authenticate devices, provide encrypted vault functionality, enforce delayed and revocable access, deliver security notifications, maintain a security audit history, prevent abuse, and operate the service. It is not used for advertising, marketing, cross-app tracking, or behavioral analytics.
Service providers
Custen relies on Apple for App Attest, push notifications, and App Store distribution, and on Amazon Web Services for the official Custen server. These providers process technical information under their own terms and privacy commitments. This policy website uses GitHub Pages, which records visitor IP addresses for security according to GitHub’s documentation.
Retention and deletion
Vault protocol records and encrypted document contents remain until removed through the applicable Custen workflow. A master can permanently remove a document or delete the entire vault. A recipient can leave a vault. Whole-vault deletion removes protected objects, vault-linked application state, and vault audit history after scheduled cleanup completes.
After whole-vault deletion, the server retains a minimal permanent revocation marker containing only an opaque device identifier and revoked status. This lets a device that was offline during deletion erase its Custen-managed local state when it next connects. Operational Lambda logs are configured for 30-day retention, and AWS control-plane security-trail logs are configured for 365-day retention.
Deleting or revoking data in Custen cannot remove plaintext that a legitimate user previously exported to storage outside Custen.
On-device information
Custen stores installation references and optional encrypted offline document copies using iOS protection mechanisms. Sensitive actions require biometrics and use non-exportable Secure Enclave keys. The app does not persist recovery secrets, plaintext document keys, or plaintext documents. Temporary plaintext exports are removed by Custen after their share lifecycle, but copies saved elsewhere are controlled by the chosen destination.
Children
Custen is not directed to children and is not intended for use by children without the involvement and authorization of an appropriate adult vault master.
Changes
Material changes to this policy will be published at this URL with an updated date. App Store privacy disclosures will be updated when Custen’s data practices change.
Contact
For privacy or support questions, email custen.support@protonmail.com.