Anonymous, Even When You Switch Phones

We built Civasure on a simple promise: when you answer a readiness survey, you do it anonymously. No account. No name. No email. Nothing that lets us — or the county reading the data — figure out that a response came from you.

That promise runs into a fair question the moment you get a new phone: if you don’t know who I am, how do my past responses show up when I reinstall the app? And if my private Vault of documents can come back on a new device, doesn’t that mean you’re keeping track of me?

It’s a good question, and the answer is genuinely subtle. So here it is, plainly.

”Anonymous” means we don’t know who you are — not that we forget you exist

There are two different things people mean by “anonymous,” and they get mixed up:

1. We can’t identify you. We never collect your name, email, phone number, or anything that ties a survey response to a real person. This is the promise we make, and it doesn’t change.
2. We forget you every time you close the app. This one we never promised — and if we did, the product would be worse for you. You’d lose the ability to update your own survey answers, and a Vault that vanished every time you replaced your phone would defeat its entire purpose.

The important part is #1. Keeping your data available to you across devices does not require us to know who you are.

What actually moves to your new phone — and who’s holding it

When you first use Civasure, your phone creates a couple of keys: one that lets you update your own survey responses later, and (if you use the Vault) one that encrypts your documents.

Those keys are stored the same way your saved passwords are — in iCloud Keychain on iPhone, or Google’s backup on Android. When you set up a new phone and restore it, the operating system brings those keys along, the same way it brings your Wi-Fi passwords and logins.

Here’s the part that matters:

• That restore happens between you and Apple or Google. Not us. We are not involved. There is no “log in to Civasure,” no account, no OAuth, no email — because there’s nothing to log into.
• We never see your Apple or Google identity. From our side, a returning phone just shows up holding a key. We can verify the key is valid, but the key is an opaque token — it isn’t your name, and we can’t map it back to a person.

So your responses “follow you” not because we tracked you, but because your phone kept your own key and brought it to the new device. We’re just the place your (encrypted, anonymous) data was waiting.

Your Vault: we can’t read it, even if we wanted to

The Vault — where you can keep insurance cards, IDs, medication lists, and photos of your belongings — goes a step further. Everything in it is encrypted on your phone before it ever leaves, with a key only your device holds.

We store the encrypted bytes so they survive a lost phone. But we cannot read them. Not with a warrant, not if we were breached, not if we changed our minds. That’s not a policy we promise to follow — it’s a property of the math. This is what “zero-knowledge” means: the knowledge simply isn’t on our side to give.

You’re in control, and we’ll be honest about the edges

This is on by default because it makes the product work better for you, and because — as above — it never costs you your anonymity. But it’s your call:

• There’s a toggle in Settings (“Keep responses across phones”). Turn it off and your key stays on this device only, the way it worked before. You lose cross-device recovery; you keep nothing else.
• Two honest caveats we won’t paper over:
  • Recovery is best-effort. It only works if iCloud Keychain (or your Google backup) is turned on. If it’s off, your key can’t travel — and for the Vault, that means those documents are genuinely unrecoverable. That’s the flip side of us never being able to read them.
  • Opting out isn’t instant erasure. A copy already synced to iCloud or Google may take time to clear from their systems as the change propagates. We don’t control that timeline, so we won’t pretend it’s immediate.

Why we’re telling you this

We could have shipped “your stuff comes back on a new phone” and said nothing about the mechanism. Most apps do. But the whole reason people trust an anonymous tool is that it behaves the way they’d expect if they understood it — so when there’s a nuance, we’d rather name it than hope you don’t notice.

Anonymous doesn’t mean we forget you every time you replace your phone. It means we never know who you are in the first place. Both of those can be true at once, and keeping them both true is the point.

Learn more about how Civasure protects your privacy.