Legal
The short version: KidsReward, Sprout, SSH Console, Everyday, Vaultkeep, Petal, Photobooth, Bunga, WorldStamp, Invoice Generator, and Audrey's Island have no server and no accounts, so there's almost nothing for us to collect — everything below explains exactly what stays on your device, what (optionally) goes to your own iCloud, and what myJourney does differently. No jargon, no surprises.
TheVimes ("we," "us") publishes this policy for the KidsReward, Sprout, SSH Console, Everyday, Vaultkeep, Petal: Mood Diary, Photobooth, Bunga: Daily Malay, WorldStamp, Invoice Generator, and Audrey's Island apps and for thevimes.com itself. TheVimes also publishes a separate app, myJourney, which lives at its own address (myjourney.thevimes.com) and is covered by its own privacy policy, since it collects different information for a different purpose. See section 18 for how they relate.
KidsReward is a family app used on a single family device. A parent or guardian sets it up and uses it to track stamps, rewards, and a simple cash & savings "wallet" for their kids; kids also use its Learning tab themselves to practise Malay words, music note reading, and mental maths. It does not have accounts, sign-in, or a server of any kind that we operate.
Information you enter into the app — for example:
is stored only on your device, using the operating system's standard local app storage. We do not operate any server that this data is sent to, and we — the people who make KidsReward — never see it, cannot access it, and have no way to recover it if it's lost.
The Learning activities (word lists, music notation, maths questions, fonts and artwork) are built into the app and make no network requests. To read Malay words aloud, KidsReward passes the word being practised to your device's built-in text-to-speech feature. On iPhone and iPad this is Apple's on-device speech; on Android it is the text-to-speech engine you have installed, which is a separate app with its own privacy policy. Nothing else is sent, and sound can be turned off in each learning app's Settings. KidsReward does not use the microphone.
On iOS, KidsReward can back up this same information (kids, rewards, stamp history, wallet data, and learning progress — not photos, and not the lists of missed words) to Apple's iCloud, so it can be restored if you delete and reinstall the app. This uses Apple's own iCloud key-value storage under your personal iCloud account. That data is subject to Apple's own privacy policy, is encrypted and controlled by you through your device's Settings, and is never sent to, or visible to, TheVimes. Photos you add for a kid or a reward are kept only in the app's local storage on that one device and are not backed up by this sync.
If you choose to add a real photo for a kid or a reward, KidsReward asks for permission to use your camera or photo library at that moment. The photo is saved directly to the app's local storage on your device; it is not uploaded anywhere. You can remove a photo at any time from within the app, or revoke camera/photo permission at any time in your device's Settings.
KidsReward is made for families with children, and is listed in the App Store's Kids Category. A parent or guardian sets it up and manages stamps, rewards, and wallets; children use it too — especially the Learning tab, which they can use on their own.
KidsReward collects no personal information from children (or from anyone else). Everything described above stays on the family's own device and, optionally, the family's own iCloud account — we run no servers that the app talks to, so we have no way to receive it. The app has:
A parent can delete a child's information at any time by removing that kid in the app, resetting a learning app's progress in its Settings, or deleting the app (see Your choices & data deletion).
KidsReward, Sprout, SSH Console, Everyday, Vaultkeep, Petal, Photobooth, Bunga, WorldStamp, Invoice Generator, and Audrey's Island contain no advertising, no third-party analytics, and no crash-reporting SDKs. We do not:
Sprout is a daily sight-reading practice app for kids. Like KidsReward, it has no accounts, sign-in, or server of any kind that we operate — it's a single-device app that works fully offline.
Information entered into the app — for example:
is stored only on your device, using the browser's or app's standard local storage. Sprout does not use the camera or photo library — avatars are chosen from a built-in set of emoji, not uploaded photos. We do not operate any server this data is sent to, and we never see it, cannot access it, and have no way to recover it if it's lost.
Unlike KidsReward, Sprout is designed for a child to use directly for practice sessions, though a parent or teacher sets up the profile and practice range. Sprout has no chat, social features, ads, in-app purchases, or any way to communicate with anyone else — it collects no information from children over the internet, since everything stays on the family's own device and we run no server the app talks to.
SSH Console is a terminal app for connecting to servers you choose, over SSH. Like KidsReward and Sprout, it has no accounts, sign-in, or server of any kind that we operate — the app talks directly to the servers you connect it to, and to nowhere else.
Information you enter or create in the app — for example:
is stored only on your device, in the app's private storage, which is excluded from iCloud and device backups. Passwords and key passphrases you type in are used only to make that one connection and are never saved as part of a saved server — you'll be asked for them again next time — and are sent only to the server you're connecting to, never to us. We do not operate any server this data passes through, and we never see it, cannot access it, and have no way to recover it if it's lost.
If you turn on the optional app lock, its password is stored in your device's secure Keychain, and Face ID / Touch ID is handled entirely by iOS — SSH Console never sees your biometric data. Deleting the app removes the app lock along with everything else.
SSH Console asks for permission to reach devices on your local network, since that's how it connects to servers on your home or office network, and may ask for Face ID access if you turn on app lock. It does not use the camera or photo library, has no chat, social features, ads, or in-app purchases, and collects no information from anyone over the internet beyond talking to the servers you tell it to connect to.
Everyday brings together checklists, receipts, countdowns, home maintenance, notes, finance, passwords, a mood diary and, on iPhone, Declutter. Like our other apps, it has no accounts, sign-in, or server of any kind that we operate, and apart from the one optional feature described below, it makes no network requests.
Information you create in the app — for example:
is stored only on your device, in the app's private storage. We do not operate any server this data is sent to, and we never see it, cannot access it, and have no way to recover it if it's lost.
Passwords are encrypted on your device before they are stored, with AES-256 authenticated with HMAC-SHA256. The encryption key is created on your device and kept in its secure storage (the Keychain on iOS, the Keystore on Android), readable only while your device is unlocked. It is never synced or restored to another device, so saved passwords can only move to a new phone through an in-app backup. There is no master password; the optional app lock adds Face ID, Touch ID, fingerprint, or passcode protection.
The one optional network feature: breach checking. In Passwords, the Security screen can check your saved passwords against the Have I Been Pwned breach database. It is off by default and only runs when you turn it on and start a check. For each password, Everyday computes a SHA-1 hash on your device and sends only the first 5 characters of that hash to api.pwnedpasswords.com — never the password and never the full hash. The service returns a list of matching hash endings, and Everyday checks on your device whether yours is among them, so the service cannot work out your password from what it receives.
Declutter (iPhone). Declutter helps you remove duplicate photos and duplicate contacts. It asks for access to your photo library to find duplicate, burst, and look-alike photos, and for access to your contacts to find people saved more than once. All analysis runs on your device (using Apple's on-device Vision framework for photos); no photo or contact is uploaded, copied out of your library, or sent anywhere. Photos are only deleted when you choose to, and iOS asks you to confirm; they go to your Recently Deleted album for 30 days. Contacts are only merged or deleted when you confirm it in the app.
Permissions. Everyday asks for the camera and photo library only when you choose to take or attach a photo or video, set a countdown background or diary wallpaper, or use Declutter; the microphone only when you record a voice memo, voice note, or video; contacts only when you use Declutter's contact cleanup; and notifications for the reminders you turn on (due dates, maintenance, and the optional daily diary reminder). Reminders are scheduled on your device. Face ID, Touch ID, or your passcode is used only if you turn on the app lock, and is handled entirely by the operating system — Everyday never sees your face or fingerprint data. Everyday does not use your location. You can change any of these permissions in your device's Settings.
Widgets and backups. On iOS, Everyday's Home Screen widgets read a summary of your lists and countdowns from storage shared with the app on the same device — this never leaves your device. When you create a backup in the app (Settings → Backup & Restore, which covers every feature), Everyday makes a file and hands it to your device so you choose where to save it; it never uploads it anywhere itself. Saved passwords in a backup stay encrypted with a backup password you choose; the rest of the backup is not encrypted, so keep the file somewhere private. On iPhone and iPad, app data may also be included in your own iCloud or computer backup, depending on your backup settings; Apple handles those backups under its own privacy policy, and we have no access to them.
Everyday is not directed at children under 13. It has no chat, social features, ads, analytics, or in-app purchases.
Vaultkeep is a password manager. Like our other apps, it has no accounts, sign-in, or server of any kind that we operate, and it works fully offline.
Information you save in the app — for example:
is encrypted on your device before it is stored, and stays only on your device. Your master password is run through PBKDF2 (600,000 rounds of SHA-256) to derive a key, and that key encrypts the whole vault with AES-256, authenticated with HMAC-SHA256. Your master password itself is never stored or sent anywhere. We do not operate any server this data is sent to, and we never see it, cannot access it, and have no way to recover it — if you forget your master password and have no backup, the vault cannot be opened by us or anyone else.
If you turn on Face ID, Touch ID, or fingerprint unlock, your device's secure hardware (the Keychain on iOS, the Keystore on Android) keeps your vault key behind that check. The biometric itself is handled entirely by the operating system — Vaultkeep never sees your face or fingerprint data.
Backups. Creating a backup produces an encrypted file, protected by a password you choose, which Vaultkeep hands to your device's share sheet so you decide where it goes (Files, iCloud Drive, Google Drive, email, and so on). Vaultkeep never uploads it anywhere itself. The optional Export as CSV option creates an unencrypted file for moving to another password manager — anyone who gets that file can read it, so delete it once you're done. On iPhone and iPad, the encrypted vault may also be included in your own iCloud or computer backup, depending on your backup settings; it stays encrypted there, and we have no access to those backups.
The one optional network feature: breach checking. Vaultkeep's Security tab can check your saved passwords against the Have I Been Pwned breach database. It is off by default and only runs when you turn it on and tap Check Now. For each password, Vaultkeep computes a SHA-1 hash on your device and sends only the first 5 characters of that hash to api.pwnedpasswords.com — never the password and never the full hash. The service returns a list of matching hash endings, and Vaultkeep checks on your device whether yours is among them. This "k-anonymity" method means the service cannot work out your password from what it receives. Apart from this feature, Vaultkeep makes no network requests.
Vaultkeep does not use the camera, microphone, contacts, or location. It is not directed at children under 13, and has no chat, social features, ads, or in-app purchases.
Petal is a personal mood diary. Like our other apps, it has no accounts, sign-in, or server of any kind that we operate, and it works fully offline — it makes no network requests at all. Its background music is built into the app.
Information you add in the app — for example:
is stored only on your device, in the app's private storage. We do not operate any server this data is sent to, and we never see it, cannot access it, and have no way to recover it if it's lost. Your daily letter is picked at random on your device.
Petal asks for the camera only when you choose to take a photo or video, the photo library only when you choose to attach a photo or video or pick a calendar wallpaper, and the microphone only when you record a voice note or a video. Anything you capture or choose is copied into the app's private storage and never uploaded. You can change these permissions at any time in your device's Settings.
If you turn on the optional daily reminder, Petal asks for permission to send notifications. The reminder is scheduled on your device for the time you choose — it is a local notification, so no push service, server, or account is involved, and you can turn it off in Me → Settings or in your device's Settings.
Your diary may be included in your own iCloud or computer backup (iPhone and iPad) or your Google device backup (Android), depending on your backup settings, so it can be restored on a new device. Apple and Google handle those backups under their own privacy policies, and we have no access to them.
Petal is not directed at children under 13. It has no chat, social features, ads, analytics, or in-app purchases.
Photobooth turns your phone or tablet into a photo booth. Like our other apps, it has no accounts, sign-in, or server of any kind that we operate, and it makes no network requests — it works fully offline.
Photobooth asks for the camera to take your photos and, in Live GIF mode, short silent video clips. It does not use the microphone: clips are recorded without sound. Everything you capture — photos, clips, and the finished strips and GIFs, including your captions and stickers — is processed and stored only on your device, in the app's private storage. We never see it, cannot access it, and have no way to recover it if it's lost.
The app asks for access to your photo library only when you choose to import photos into a strip or save a finished strip (or turn on auto-save). It only reads the photos you pick and only adds the strips you save. When you share or print a strip, it's handed to the app, service, or printer you choose, whose own privacy policy then applies.
Your settings (such as countdown length, default frame, and event mode) are also stored only on your device. Photobooth has no chat, social features, ads, analytics, or in-app purchases, and is not directed at children under 13.
Bunga is a daily Malay vocabulary practice app. Like our other apps, it has no accounts, sign-in, or server of any kind that we operate, and it makes no network requests — the word list, fonts, and artwork are all built in, so it works fully offline.
Information entered into the app — for example:
is stored only on your device, in the app's private storage. We never see it, cannot access it, and have no way to recover it if it's lost. Bunga does not ask for access to your camera, microphone, photos, contacts, location, or any other device permission.
To read Malay words aloud, Bunga passes the word being practised to your device's built-in text-to-speech feature. On iPhone and iPad this is Apple's on-device speech; on Android it is the text-to-speech engine you have installed, which is a separate app with its own privacy policy. Nothing else is sent, and you can turn sound off in Settings.
Bunga is a general-audience learning app. It has no chat, social features, ads, analytics, or in-app purchases, and since it collects no personal information from anyone, it collects none from children.
WorldStamp turns your photos into stamps and keeps them in stamp books on your device. Like our other apps, it has no accounts, sign-in, or server of any kind that we operate.
Information you create in the app — for example:
is stored only on your device, in the app's private storage. We never see it, cannot access it, and have no way to recover it if it's lost.
WorldStamp asks for these permissions, each only for what's described:
To print a place name on a stamp, the coordinates of the photo are sent to a place-lookup service: your device's built-in geocoder (provided by Google on Android), then BigDataCloud if that has no answer. When you type a place to search for, that text is sent to OpenStreetMap Nominatim. Map tiles are loaded from Google Maps. Only the coordinates or search text are sent, along with standard connection information such as your IP address; each service has its own privacy policy, and we never receive any of it.
Backup & Restore writes one file with your stamps, books, and photos to wherever you choose, such as a folder on your phone or Google Drive. That file is not encrypted and is handled by the storage you pick — we never receive it. The Share button passes a stamp image only to the app you choose.
WorldStamp has no chat, social features, ads, analytics, or in-app purchases, and is not directed at children under 13.
Invoice Generator lets you create invoices and receipts, turn them into PDFs, and send them to your customers. Like our other apps, it has no accounts, sign-in, or server of any kind that we operate, and it makes no network requests of its own — it works fully offline.
Information you enter in the app — for example:
is stored only on your device, in the app's private storage. We never see it, cannot access it, and have no way to recover it if it's lost. PDFs are created on your device.
The app asks for access to your photos only when you choose a logo, using the system photo picker, so it can read only the one image you pick. It does not use the camera, microphone, location, or contacts.
When you send a document by email, WhatsApp, share, or print, the PDF and message are handed to the app, service, or printer you choose, whose own privacy policy then applies. Backup & Restore writes one file with all your data to wherever you choose, such as Google Drive or your email. That file is not encrypted and is handled by the storage you pick — we never receive it.
Invoice Generator has no chat, social features, ads, analytics, or in-app purchases, and is not directed at children under 13.
Audrey's Island is a single-player treasure-hunting puzzle game. Like our other apps, it has no accounts, sign-in, or server of any kind that we operate, and it makes no network requests at all — the artwork, music, and fonts are built into the app, so it works fully offline.
The only information the app keeps is your game progress: the stages and islands you've unlocked, your coins, gems, and supplies, the diggers you've recruited, when you last opened the daily message in a bottle, and your sound and music settings. It is stored only on your device, in the app's private storage. We never see it, cannot access it, and have no way to recover it if it's lost.
Audrey's Island does not ask for access to your camera, microphone, photos, contacts, location, notifications, or any other device permission. It uses vibration for haptic feedback during play.
Your progress may be included in your own iCloud or computer backup (iPhone and iPad) or your Google device backup (Android), depending on your backup settings, so it can be restored on a new device. Apple and Google handle those backups under their own privacy policies, and we have no access to them.
Audrey's Island is suitable for children. It has no chat, social features, ads, analytics, in-app purchases, or links out of the app, and since it collects no personal information from anyone, it collects none from children under 13 (or the equivalent age where you live).
This website is a small set of static pages. It does not use cookies, does not run any analytics or advertising script, and does not collect any personal information from visitors. If you email us, we'll have whatever information you chose to include in that email — nothing more.
myJourney is a separate app by TheVimes with a different purpose (turning walking/running into progress toward destinations and group challenges with friends), and it collects different information to do that — for example, an account, adventure details, and aggregated distance data synced through a server it runs. That is documented in full in myJourney's own privacy policy, which governs that app rather than this one.
Because KidsReward's, Sprout's, SSH Console's, Everyday's, Vaultkeep's, Petal's, Photobooth's, Bunga's, WorldStamp's, Invoice Generator's, and Audrey's Island's data lives on your device (and, for KidsReward, if enabled, your own iCloud account), you're always in control of it:
Since we have no account system and no server, there is no separate "delete my account" request to make to us — removing the app (and, for KidsReward, its iCloud data) removes everything.
If this policy changes, we'll update the "Last updated" date at the top of this page. Continued use of KidsReward, Sprout, SSH Console, Everyday, Vaultkeep, Petal, Photobooth, Bunga, WorldStamp, Invoice Generator, or Audrey's Island after a change means you accept the updated policy.
Questions about this policy, KidsReward, Sprout, SSH Console, Everyday, Vaultkeep, Petal, Photobooth, Bunga, WorldStamp, Invoice Generator, or Audrey's Island? Email janice88888888@gmail.com. For myJourney, see the contact details on its own privacy policy.