Supplemental Terms of Use

1. Agreement and relationship to Apple’s Standard EULA

These Supplemental Terms of Use (the “Terms”) are a legally binding agreement between you and Tuvo Labs Limited Co (“Tuvo Labs,” “we,” “us,” or “our”) concerning the Kryptis mobile application, this website, and related features and services (collectively, “Kryptis”). By downloading, accessing, or using Kryptis, you accept these Terms and acknowledge our Privacy Policy. If you do not agree, do not use Kryptis.

You and Tuvo Labs acknowledge that these Terms are between you and Tuvo Labs, not Apple. As allocated in the Standard EULA, Tuvo Labs—not Apple—is responsible for Kryptis and its content, maintenance and support, product claims, applicable warranties, and claims that Kryptis infringes a third party’s intellectual-property rights. Apple has no obligation to furnish maintenance or support for Kryptis. If the app fails to conform to an applicable warranty, the remedies involving Apple are limited to those stated in the Standard EULA and mandatory law.

Apple and its subsidiaries are third-party beneficiaries of these Terms as they relate to the app. After you accept these Terms, Apple may enforce those provisions against you as a third-party beneficiary. Except for that limited right, these Terms create no third-party beneficiary.

2. Eligibility

You must be at least 13 years old to use Kryptis. If you have not reached the age of legal majority where you live, you may use Kryptis only with permission from a parent or legal guardian who has reviewed and agreed to these Terms on your behalf. That adult is responsible for your use of Kryptis. If you use Kryptis for an organization, you represent that you are authorized to bind it, and “you” includes that organization.

You may not use Kryptis if doing so is prohibited by applicable law. You represent that you are not located in a country subject to a United States government embargo or designated as supporting terrorism, and that you are not listed on a United States government prohibited- or restricted-party list. You must also comply with any third-party terms that apply when you use Kryptis.

3. Kryptis services

Kryptis is a privacy utility centered on an encrypted, local-first vault. Depending on your device, permissions, configuration, and app version, features may include:

• storing protected copies of selected photos, videos, contacts, identity or card details, and related vault metadata on your device;
• PIN, recovery, decoy-vault, and intruder-report tools controlled on your device;
• user-initiated local transfer and encrypted backup to a personal storage account you control;
• temporary email aliases and short-lived message access; and
• user-initiated import of eligible media from a publicly accessible web address.

Feature availability and technical limits may change. Descriptions in Kryptis are informational and are not a promise that every feature will remain available, work with every device or source, or meet a particular purpose.

4. Limited permission to use Kryptis

Subject to the Standard EULA, these Terms, and applicable law, Tuvo Labs gives you a limited, personal, revocable, nonexclusive, nontransferable right to access and use Kryptis for its intended purposes. Kryptis is licensed, not sold. No rights are granted by implication.

You may use the app only on devices and through sharing arrangements permitted by the Standard EULA and applicable platform rules. You may not rent, lease, sell, sublicense, distribute, copy, modify, create derivative works from, or commercially exploit Kryptis except where applicable law expressly permits an act that cannot lawfully be restricted.

5. Your vault, credentials, and backups

You are responsible for safeguarding your device, vault PIN, recovery secret, encryption material, device passcode, and personal storage credentials. To preserve the privacy design of Kryptis, Tuvo Labs does not possess the information needed to unlock your local vault and cannot recover a forgotten PIN or recovery secret, reconstruct encryption keys, or restore local vault content for you.

App deletion, device loss or damage, an operating-system reset, storage corruption, failed migration, forgotten credentials, overwritten files, device modifications, or unsupported restoration steps may make content permanently unavailable. You accept these risks and are responsible for testing backups and restoration before relying on them.

If you choose encrypted backup to a personal storage account, that account and its availability remain under your control and are subject to separate terms. Tuvo Labs does not control that account, guarantee that an upload completed, or guarantee that a backup remains available or can be decrypted later.

6. User content and required rights

As between you and Tuvo Labs, you retain your ownership rights in photos, videos, messages, contact copies, records, URLs, and other material you select, create, receive, store, or process through Kryptis (“User Content”). These Terms do not transfer ownership of User Content to us.

When you affirmatively use a feature that requires off-device processing, you give Tuvo Labs a limited, nonexclusive, worldwide, royalty-free permission to receive, process, encrypt, transmit, and temporarily retain the affected User Content only as reasonably necessary to provide, secure, troubleshoot, and legally operate that feature. This permission ends when that purpose and the stated retention period end, except for information we must preserve by law or for a properly documented dispute.

You represent that you have every right, permission, notice, and consent needed to use the User Content with Kryptis. Your use must not violate another person’s privacy, publicity, confidentiality, contractual, intellectual-property, or other rights. You are responsible for User Content and for deciding whether Kryptis is appropriate for it.

7. Acceptable use

You must not use Kryptis to:

• break the law, facilitate unlawful conduct, or violate another person’s rights;
• create, obtain, store, share, or conceal child sexual-abuse material, nonconsensual intimate imagery, stolen content, or material you are not legally entitled to possess;
• harass, threaten, stalk, secretly surveil, exploit, defraud, impersonate, or endanger another person;
• send spam, malware, abusive communications, or deceptive temporary email;
• access another person’s device, vault, correspondence, or data without authorization;
• defeat authentication, rate limits, access controls, security measures, source restrictions, paywalls, or digital-rights controls;
• scrape, crawl, automate, overload, disrupt, probe, reverse engineer, or interfere with Kryptis, except to the limited extent a restriction is prohibited by law;
• introduce malicious code or use Kryptis to test attacks against people or systems without express authorization; or
• use Kryptis in a safety-critical, emergency, medical, evidentiary, or other context where delay, error, or data loss could cause serious harm.

You may not encourage or help anyone do any of the above. We may investigate suspected abuse, preserve relevant records as permitted by law, restrict requests, and cooperate with lawful process.

8. Public-media imports

The public-media import feature is limited to eligible media at a public HTTPS address that can be accessed without credentials, private cookies, circumvention, or special authorization. It is not intended to bypass authentication, subscriptions, paywalls, source restrictions, digital-rights controls, or protections for live or private content.

You are solely responsible for the address you submit, your authority to access and copy the material, and compliance with the source’s terms and applicable copyright and privacy law. A public address does not necessarily give you permission to copy its content. Do not import material unless you have the required rights.

Imports may fail, time out, return unexpected material, vary in quality, or become unavailable. We may reject a source or request for technical, security, capacity, abuse-prevention, or legal reasons. Kryptis does not endorse or control the source, and you should inspect an imported result before saving, sharing, or relying on it.

9. Temporary email

A message may be delayed, filtered, rejected, misaddressed, malformed, or inaccessible. A sender may be deceptive. You are responsible for independently checking a sender, message, link, attachment, and extracted code before acting on it. Kryptis is not an archival mailbox and does not promise to preserve or recover expired aliases or messages.

You may not use temporary email for spam, harassment, evasion of another service’s rules, account farming, fraud, impersonation, unlawful anonymity, or interference with another person or service. We may limit, block, or discontinue access to protect users, Kryptis, or others.

10. Intruder reports, camera features, and local law

If you enable an intruder-report or camera feature, Kryptis may use your device camera and locally record information associated with an attempted vault access. Device permissions, hardware conditions, lighting, operating-system behavior, and false positives can affect the result. An intruder report does not prove identity, intent, wrongdoing, or the absence of other access attempts.

You—not Tuvo Labs—are responsible for using camera and intruder-report features lawfully, including any required notice or consent. Do not use them for covert or unlawful surveillance, in a place where recording is prohibited, or in a manner that invades privacy or creates a safety risk. Tuvo Labs does not remotely watch camera output or provide emergency monitoring.

11. Local transfer and external services

Local transfer features depend on the participating devices, network, permissions, and the recipient you select. Before sending anything, verify the receiving device and person. You are responsible for what you transfer and for securing the environment and destination. Interruptions, incompatible versions, storage limits, or user error may cause an incomplete or duplicate transfer.

Kryptis may interact with operating-system features, personal storage, email infrastructure, websites, public media sources, or other services we do not own or control. Their availability, content, security, and practices are governed by their own terms. To the maximum extent permitted by law, Tuvo Labs is not responsible for an external service or for loss caused by your reliance on it. Links do not imply endorsement.

12. Service changes, suspension, and termination

We may add, change, limit, suspend, or discontinue a Kryptis feature when reasonably necessary for security, maintenance, legal compliance, abuse prevention, technical constraints, or product operation. Where reasonably practicable, we will give notice of a material discontinuation, but urgent changes may occur without advance notice.

You may stop using Kryptis at any time. Deleting the app can also delete local data, subject to your device and personal backup configuration. We may suspend or terminate service access if you materially breach these Terms, create risk or legal exposure, abuse a feature, or if continued service is no longer reasonably feasible. A restriction may apply to a request source or pseudonymous installation identifier even though Kryptis does not use a conventional account.

Provisions that by their nature should continue—including ownership, disclaimers, liability limits, indemnification, dispute resolution, and general terms—survive termination. Termination does not create a duty for Tuvo Labs to recover local data or expired temporary content.

13. Kryptis intellectual property and feedback

Kryptis, including its software, visual design, text, graphics, trademarks, service marks, and other materials supplied by Tuvo Labs, is owned by Tuvo Labs or its licensors and is protected by intellectual-property laws. These Terms do not authorize you to use Kryptis branding or remove proprietary notices.

If you voluntarily provide an idea or suggestion about Kryptis, you give Tuvo Labs a perpetual, irrevocable, worldwide, transferable, sublicensable, royalty-free right to use and commercialize that feedback without restriction or compensation. Do not submit feedback you are not entitled to provide or that you expect us to treat as confidential.

14. Disclaimers of warranties

Without limiting that disclaimer, we do not warrant that Kryptis will be uninterrupted, timely, secure, error-free, compatible, or free of harmful components; that encryption or device protections cannot be defeated; that an intruder report, permission state, notification, temporary message, code, import, transfer, or backup will be complete, accurate, authentic, delivered, or recoverable; or that content will never be lost, exposed, corrupted, or accessed without authorization.

You assume the risk of downloading, storing, deleting, transferring, importing, or relying on content through Kryptis. Kryptis is not professional, legal, cybersecurity, emergency, identity-verification, archival, or evidentiary advice or service. No statement outside these Terms creates a warranty unless an authorized Tuvo Labs representative expressly agrees in writing.

Some jurisdictions do not allow particular warranty exclusions. In that event, the exclusions apply only to the maximum extent permitted, and you retain any nonwaivable consumer rights.

15. Limitation of liability

The exclusions and cap apply whether a claim is based in contract, tort, negligence, strict liability, statute, warranty, restitution, or another theory, and even if a limited remedy fails of its essential purpose. They are a fundamental allocation of risk and apply without regard to whether Kryptis was free.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited, which may include liability for fraud, willful misconduct, gross negligence, death or personal injury caused by negligence, or violation of nonwaivable consumer rights. Where an exclusion is not allowed, liability is limited to the fullest extent permitted by law.

16. Indemnification

To the extent permitted by law, you will defend, indemnify, and hold harmless Tuvo Labs and its affiliates, owners, officers, directors, employees, agents, licensors, and service contractors from third-party claims, losses, liabilities, judgments, penalties, damages, costs, and reasonable legal fees arising from: (a) your User Content; (b) your misuse of Kryptis; (c) your violation of these Terms or applicable law; or (d) your violation of another person’s rights.

This obligation does not apply to the extent a claim was caused by the protected party’s own conduct for which indemnification may not lawfully be required. We will give reasonable notice of a covered claim and may control its defense and settlement. You will reasonably cooperate and may participate with counsel at your own expense. We will not agree to a settlement that requires you to admit fault or pay an unindemnified amount without your consent, which will not be unreasonably withheld.

17. Dispute resolution and binding individual arbitration

A “Dispute” means any claim or controversy between you and Tuvo Labs arising out of or relating to Kryptis, these Terms, the Privacy Policy, User Content, communications, or the parties’ relationship. It includes claims arising before or after these Terms and claims based on contract, tort, negligence, statute, fraud, misrepresentation, privacy, data protection, or any other legal or equitable theory. The Federal Arbitration Act governs the interpretation and enforcement of this arbitration agreement.

The parties will try in good faith to resolve the Dispute for 60 days after a complete notice is received. If either party timely requests it, both parties must participate personally in an individualized telephone or video settlement conference; counsel may also attend. No arbitration may be filed until this process is complete. Any limitations period and filing-fee deadline is tolled during this informal period. A court may enforce these pre-filing requirements or enjoin an arbitration filed without satisfying them.

The arbitrator decides issues concerning the scope, validity, or enforceability of this arbitration agreement. AAA and any Process Arbitrator decide administrative questions assigned to them under the Mass Arbitration Supplementary Rules, including whether filings qualify for mass-arbitration administration. A court decides whether the class-action waiver has been violated or is unenforceable, whether the pre-arbitration requirements were satisfied, requests for public injunctive relief that applicable law does not permit to be arbitrated, and the effect of an arbitration opt-out. If AAA cannot administer an individual arbitration, the parties will try to select another nationally recognized administrator, and otherwise a court may appoint an arbitrator under federal law.

If we make a material future change to this arbitration agreement, you may reject that change by sending a personally signed notice within 30 days after the change takes effect. Rejecting a change leaves the last arbitration agreement you accepted in force, unless you previously opted out altogether. A change does not apply to a Dispute for which either party received a complete Notice of Dispute before the change’s effective date.

Except for the individual-proceedings rule addressed above, if any part of this Section is unenforceable, it will be severed and the remainder will remain in effect. If AAA’s rules conflict with this Section, this Section controls to the extent permitted by applicable law and the administrator’s minimum fairness requirements.

18. Governing law

The Federal Arbitration Act governs Section 17. Except to the extent federal law or nonwaivable law where you live applies, Arizona law governs these Terms without regard to conflict-of-laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

For a Dispute that is not subject to arbitration or small-claims court, you and Tuvo Labs consent to the exclusive jurisdiction and venue of the state and federal courts located in Maricopa County, Arizona, unless applicable consumer law gives you a nonwaivable right to proceed elsewhere.

19. General terms

We may update these Terms to reflect changes in Kryptis, law, security, or our practices. The revised Terms will identify a new effective date. We will provide additional notice in Kryptis or by another reasonable method before a material change takes effect when required by law. Your continued use after the effective date means you accept the revised Terms; if you do not agree, stop using Kryptis. Changes to arbitration are also subject to Section 17.

These Terms, the Standard EULA, and documents expressly incorporated by reference are the entire agreement about their subject matter and supersede prior or contemporaneous statements on that subject. A failure to enforce a provision is not a waiver. If a provision is unenforceable, it will be enforced to the maximum lawful extent and the remainder will continue, subject to the special severability rule in Section 17.

You may not assign or transfer these Terms without our written consent. We may assign them as part of a merger, financing, reorganization, sale of assets, or by operation of law. Notices and agreements may be provided electronically. Section titles are for convenience only. “Including” means “including without limitation.”

Tuvo Labs is not responsible for delay or failure caused by circumstances beyond its reasonable control, including natural disasters, labor disputes, governmental actions, internet or utility failures, malicious attacks, platform changes, or failure of an external service. This does not limit any responsibility that cannot lawfully be limited.

20. Contact

Questions, notices, or support requests may be sent by email to hello@tuvolabs.com or by mail to: