CipherKit is made by Zossoz, Inc. ("Zossoz," "we," "us"). CipherKit holds ciphertext you are working on and, in the Vault, notes you deliberately chose to encrypt — so it is built on a simple rule: it works offline, and we never see any of it.
The short version
- CipherKit has no account and no sign-up.
- We operate no servers and collect no personal data. CipherKit contains no networking code at all — it works with the radios off.
- Your ciphers, history, puzzle progress and Vault live only on your device. There is no cloud sync.
- The Vault is encrypted with AES-256-GCM, and its key is generated on your device and never leaves it.
- Camera and photo access are used only for text recognition, and only when you ask.
- No ads, no analytics, no tracking, no data sales. Ever.
What CipherKit stores, and where
Your saved ciphers and decoded results, your history, your puzzle progress, streaks, stats and achievements, and your settings are stored locally on your device. Some of it sits in a private App Group container shared only between CipherKit and its own widget and share extension, so the widget can show your streak. None of it is sent anywhere — we have no servers to send it to.
The Vault
Vault entries are encrypted on your device with AES-256-GCM before they are written to storage. The encryption key is generated on your device and stored in the iOS Keychain, marked so that it is available only when the device is unlocked and only on that device — it is not synced to iCloud Keychain and it cannot be extracted by us.
Unlocking the Vault uses Face ID, Touch ID, or your device passcode through Apple's authentication framework. CipherKit is told only whether the check succeeded; it never receives your biometric data, which never leaves Apple's Secure Enclave.
Zossoz cannot decrypt your Vault and cannot recover it. If you delete the app, the key goes with it.
Camera, photos and text recognition
CipherKit can read ciphertext out of a photo, a screenshot, or the live camera. That uses Apple's on-device text recognition; the image is processed on your device, is not stored by CipherKit, and is never transmitted. Camera and photo library access are requested only when you use those features, and you can decline and type the text in yourself.
Notifications
If you turn on the daily challenge reminder, CipherKit schedules an ordinary local notification on your device. It is calculated and delivered entirely on-device. These are local notifications only — CipherKit has no push server and receives no remote notifications.
Apple Watch
If you use the watch app, CipherKit sends your current streak and a summary of the day's challenge to your paired Apple Watch over Apple's device-to-device connection. That data goes from your phone to your watch and nowhere else.
On-device intelligence
On devices with Apple Intelligence, you can turn on AI Explanations in Settings. CipherKit then uses Apple's on-device model to explain what a cipher does, write a hint for a puzzle you are stuck on, describe why a decode attempt scored the way it did, or generate a new puzzle on a theme. It runs entirely on your device, it is off unless you turn it on, and every one of those features falls back to hand-written text when it is unavailable.
Purchases
CipherKit is a paid app. CipherKit Pro is available as an optional one-time lifetime unlock or a yearly subscription, both handled entirely by Apple through the App Store — Zossoz never sees your payment details. Subscriptions renew through your Apple ID and can be managed or cancelled in iOS Settings → your name → Subscriptions. You can restore a past purchase at any time.
Third-party services
None. There are no analytics or tracking SDKs, no crash reporting services, no advertising networks, and no external AI APIs. CipherKit ships with no third-party code.
What we don't do
- No analytics or tracking SDKs of any kind.
- No advertising, and no data sales — we have nothing to sell.
- No collection of names, emails, contacts, locations, or identifiers.
Children
CipherKit is not directed at children under 13 and, consistent with the rest of this policy, collects no personal information from anyone.
Deleting your data
Delete individual ciphers, history entries or Vault items in the app at any time. Deleting the app removes all locally stored data, including the Vault's encryption key.
Changes to this policy
If CipherKit's behavior ever changes in a way that affects your privacy, we will update this policy and note the new effective date above before the change ships.
Contact us
Zossoz, Inc.
Email: privacy@zossoz.com
Phone: (305) 788-2174
This policy covers the CipherKit app only. The zossoz.com website privacy policy covers this site. Questions either way: privacy@zossoz.com or (305) 788-2174.