ROLL has no accounts, no ads, no analytics and no servers. Everything you put in the vault is encrypted with AES-256 on your device, and we never receive a copy. The only ways anything leaves are ones you start yourself: a backup you export, an item you unhide or open in another app, or a transfer from your own computer over your own Wi-Fi.
the die hides the vault. this page won't tell anyone how to open it, either.
Photos, videos, files and album names are encrypted on your device with a key that never leaves it. Your code is stored only as a salted hash. We have no copy of any of it, and no way to make one.
Exporting a password-protected backup, unhiding an item to your gallery, opening a file in another app, or sending files in from your computer on the same Wi-Fi. You choose each one, and none of them go through us.
No ad networks, analytics, crash reporters or trackers. ROLL never uses your camera, microphone, contacts or location, and never photographs anyone who gets the code wrong.
Google Play or the App Store handles the purchase. We never see your payment details, and there are no in-app purchases or subscriptions.
Everything ROLL touches ends up in one of five places. Pick one to see where it lives and how long it stays.
Encrypted vault and private app storage. Never uploaded.
Only when you export, unhide or open something.
Computer to phone, local network only, never the internet.
Apple or Google handles it. We never see it.
ROLL never collects it at all.
.rollbackup file saved through your device's own dialog.ROLL ("the app") is a randomizer and private vault for Android and iOS, developed and published by Jan Aguja, an independent developer in the Philippines ("we", "us"). This policy explains what information the app handles, where it goes, and how long it stays there.
ROLL is built around a simple premise: everything you put in your vault stays on your device, encrypted, and under your control. We do not operate any servers, and the app has no concept of a user account.
Nothing. Not your files, not your code, not how often you open the app.
We do not collect anything. ROLL has no backend, no analytics SDK, no crash reporting, and no advertising network. It does not ask for your name, email address, phone number or any other personal detail. The app cannot identify you, and nothing about your use of it is ever transmitted to us or to anyone else.
Everything ROLL keeps, it keeps here, and the private parts are encrypted.
Vault content. Photos, videos, and files you add to a vault are encrypted with AES-256-GCM using a key generated on your device. The key is kept in your device's secure system storage (the iOS Keychain, or on Android, storage protected by the Android Keystore). It never leaves your device and is not accessible to us or to any other app.
Your vault code(s). Your code is stored as a salted, iterated hash, never in plain text, and never anywhere but your device. On Android you can also set up a second, fully independent vault with its own code and its own encryption key; its code is stored the same way. The App Store version for iPhone and iPad has a single vault.
Album names. Album names you create are encrypted on your device with the same AES-256-GCM key as that vault's content, never stored in the clear.
An optional hint. If you set a hint for your code during setup, it is kept in the same secure system storage, on your device only. It is shown only inside the app and is never sent anywhere.
Randomizer preferences. Ordinary settings such as your wheel labels, how many dice to roll and light or dark theme are saved in the app's local preferences. They aren't encrypted, because they're part of the everyday randomizer, but they also never leave your device.
Your phone's own backups. ROLL never uploads anything itself. Your device's system backup (for example iCloud Backup, or Google's Android backup) is controlled by your device and account settings, not by ROLL, and may include parts of the app's private storage. Vault content inside it stays in its encrypted form.
This page is deliberately vague about how the vault is opened. That's on purpose.
ROLL works as a genuine randomizer, and nothing on its main screens signals that a vault exists until the correct code is entered. To keep it that way, this policy doesn't describe the entry method, how the hint is shown, or where other hidden options live.
Every way in or out is something you start, and none of it passes through us.
ROLL's picker shows your photo library so you can choose what to add. After items are encrypted into the vault, the app asks your device to remove the originals from your gallery; your device shows its own confirmation, and you can decline. Depending on your device, removed photos may sit in a "Recently Deleted" or trash album for a while; empty it if you want them gone sooner. ROLL never scans your library in the background.
Files are chosen through your device's own file picker and copied into the vault encrypted. The original file is left where it was.
"Unhide" decrypts an item and saves it back to your photo library or to a location you pick in your device's save dialog. "Open" decrypts a file to a temporary copy and hands it to another app you choose; ROLL deletes its temporary copy a couple of minutes later, but the other app may keep its own copy under its own policy.
ROLL lets you export a vault to a single password-encrypted file (.rollbackup,
protected with Argon2id and AES-256-GCM) so you can keep a copy somewhere of your choosing: a
cloud drive, external storage, another device. The app itself never uploads this file anywhere;
where it ends up is entirely your decision, made through your device's own save dialog. Restoring
a backup requires the password you set when creating it. We do not store or have access to that
password. The screen stays awake during a backup or restore so it isn't interrupted.
ROLL includes an optional way to drag and drop files in from a computer on the same Wi-Fi network. When you open this screen, the app starts a temporary local web server on your phone, shows its local address, and shows a one-time code that the computer must enter before it can send anything. The server only runs while that screen is open and stops the moment you close it. It is only reachable by devices on your own local network and is never exposed to the internet. The transfer uses plain local HTTP within your network, so use it on a network you trust; files are encrypted into your vault as they arrive, and the page it serves loads nothing from the internet.
ROLL doesn't call home. There's no home to call.
The app makes no connections to us or to any third-party service. Its internet permission exists only so the local Wi-Fi transfer above can work. The randomizer, the vault, encryption, backups and restores all work fully offline.
The About section contains links to this website, this policy and our support email. Tapping one opens your browser or mail app, which then works under its own privacy policy.
None built in. Just the store you bought it from.
ROLL does not integrate any third-party analytics, advertising, tracking or crash-reporting SDKs, and it does not use Google Sign-In or any other authentication provider, because there is no account to sign in to. The open-source libraries it is built with (for encryption, the photo picker, video playback and so on) run entirely on your device.
The app is distributed by Google Play and the Apple App Store, which handle downloads and payment under their own policies: Google Privacy Policy and Apple Privacy Policy. If you choose to keep a backup in a cloud service, that service's own policy applies to the (still encrypted) file. We do not sell, rent or share your information with anyone.
ROLL is a one-time paid download through Google Play or the Apple App Store. The store handles the payment entirely under its own terms and privacy policy. We never see or store your payment details. There are no in-app purchases, subscriptions or ads.
Each permission is used only for the purpose listed. None of them is used to send data to us.
ROLL does not request access to your contacts, microphone or location, does not send notifications, and does not track you across other apps or websites.
It stays until you delete it. There's no copy anywhere else for us to delete.
Everything ROLL stores lives in the app's private, sandboxed storage on your device. Deleting an item inside the app removes its encrypted file. ROLL also includes a full reset that permanently erases every vault code, encryption key and all vault content on the device, then starts setup again. Uninstalling the app, or clearing its data through your device's system settings, removes the app's content as well. On iPhone and iPad, iOS may keep the app's Keychain entries (your code hash, hint and keys) after uninstalling; the in-app full reset removes those too.
There is no account or server-side copy for us to delete, because none exists. For the same reason, we cannot recover a forgotten code or restore lost content. A backup you've exported can still be restored with its own password.
Depending on where you live, including under the Philippine Data Privacy Act of 2012, the GDPR or similar laws, you may have the right to access, correct or delete personal data held about you. Because ROLL doesn't hold any personal data on any server, all of your data is already in your hands, on your device, and you can view, export or delete it there at any time. For anything else, contact us and we'll respond.
ROLL is intended for adults and is not directed at children under 13. We do not knowingly collect personal information from children; as described above, we do not collect personal information from anyone.
We may update this policy from time to time. The updated version will be posted at this address with a new effective date. If a change meaningfully affects what data leaves your device, we'll say so in the app's release notes. Continued use of the app after a change means you accept the updated policy.
For any privacy-related questions, email [email protected]. It goes straight to Jan Aguja, the developer. Please don't send your code or vault content; we never need it, and we can't use it to recover anything.