Privacy Policy

Summary

The short version, in plain language:

• No account, no servers. You don't sign up for Personal Vault, and we don't run any servers or backend. We never receive, see or have access to anything you store in your vault.
• Your vault is encrypted on your device. Passwords, cards, notes, documents, 2FA secrets and everything else you add are stored locally and encrypted.
• Backups are optional and encrypted first. If you turn on backups, they are encrypted on your device before they are saved to a folder you choose or to a hidden app folder in your own Google Drive.
• The free version shows ads from Google AdMob. We request non-personalised ads only, but Google's ad software still collects some device and usage data (such as your IP address and Advertising ID) to deliver ads and prevent fraud. Buying Pro turns the ad software off completely.
• Purchases go through Google Play. Google handles payment. We never see your card details.
• No analytics or tracking. The app contains no analytics or crash-reporting SDK. Our website uses no analytics or marketing cookies.
• We don't sell your personal information and we don't share it for cross-context behavioural advertising.

At a glance

Who we are

Personal Vault is published by Mudassir Khan ("we", "us", "our"), established in India. For the limited personal information described in this policy that we decide how to use (mainly emails you send us and transaction records from Google Play), we are the data controller (or "data fiduciary" under Indian law, "business" under Californian law, and the equivalent term elsewhere).

We are a small independent developer and have not appointed a formal Data Protection Officer, because we do not carry out large-scale processing of personal data. Privacy questions go directly to the person responsible, using the contact above.

Scope of this policy

This policy covers:

• the Personal Vault Android app (package com.personalvault.app), available on Google Play; and
• our website at personalvault-web.vercel.app, and emails you exchange with us.

It does not cover third-party services, even when the app connects to them — for example Google Play, Google Drive, Google Sign-In, Google AdMob, or any app you choose to share an item with. Those services have their own privacy policies, which we link to where relevant. For cookies and browser storage on our website, see also our Cookie Policy. Use of the app is also governed by our Terms of Service.

Information that never leaves your device

Everything you put in your vault is stored only on your device, in an encrypted database. We have no copy and no way to access it. This includes:

• passwords and password history;
• payment cards, membership cards and loyalty cards;
• secure notes;
• contacts you save in the vault;
• documents, attachments and scanned images;
• reminders;
• digital assets such as crypto wallet information, API keys and SSH keys;
• 2FA (TOTP) secrets and the codes generated from them;
• the local audit log of vault events (for example, unlocks and item changes);
• app settings, your password health results and search queries.

You may choose to store sensitive information — such as identity document numbers, health information or financial details. That information stays on your device under the same encryption. We don't process it, and we can't see it.

Features that work entirely offline

• Password generator, strength meter and password health (weak, reused or old passwords) run on your device.
• 2FA codes are generated offline from secrets stored in your vault.
• Text recognition (OCR) uses Google ML Kit on your device. Photos you take or pick through the Android system picker are processed locally and are not uploaded. See ML Kit below for the limited diagnostics Google may collect.
• Import from JSON, encrypted JSON, CSV, Bitwarden, LastPass and 1Password files happens on your device.
• Reminders are delivered as local notifications scheduled on your device — no push server is involved.
• Search runs locally.

Information processed when you use the app

The app only uses the internet for four things: showing ads (free version), optional Google Drive backup with Google Sign-In, Google Play purchases, and checking Google Play for app updates. Here is what each involves.

Advertising (Google AdMob) — free version only

The free version of Personal Vault shows ads (banner, native, interstitial, app-open and rewarded formats) using the Google Mobile Ads SDK. The app requests non-personalised ads only, meaning ads are not targeted based on your past behaviour or profile. Even so, to deliver ads Google's SDK collects and processes:

• your IP address, and an approximate location derived from it;
• device identifiers, including the Android Advertising ID;
• device and operating system information;
• app interaction and ad engagement data (for example, ad impressions and taps);
• diagnostic and crash information related to the SDK.

Google uses this data for ad delivery, frequency capping, fraud and abuse prevention, and measurement. Google may act as an independent controller of this data. Learn more in How Google uses information from sites or apps that use its services and the Google Privacy Policy. Ads never have access to your vault contents.

Consent. Where the law requires it — including in the European Economic Area, the United Kingdom and Switzerland — the app shows Google's consent message (User Messaging Platform) before any ad-related storage or access on your device. You can change your choice at any time in the app's settings. See also Your Privacy Choices.

Your controls. You can reset or delete your Advertising ID in Android Settings › Privacy › Ads (the exact path may vary by device). If you buy Pro, the ad SDK is not initialised at all, so no ad requests are made.

The app declares the com.google.android.gms.permission.AD_ID permission so the ad SDK can read the Advertising ID in the free version.

Purchases (Google Play Billing)

Personal Vault offers Pro Monthly (a subscription that renews automatically every month until you cancel) and Pro Lifetime (a one-time purchase). Pro only removes ads. All payments are processed by Google Play under Google's terms and privacy policy.

• We never see or store your card or payment details.
• Google provides us, through the Play Console, with transaction information: order ID, product, purchase date and state, country or region, price, and limited account information as Google makes available.
• Purchase verification happens on your device, and your Pro entitlement is cached in encrypted form on your device.

For refunds and cancellations, see our Refund Policy.

Google Sign-In and Google Drive backup (optional)

If you choose Google Drive as a backup destination, you sign in with your Google account. The app requests only the drive.appdata scope — a hidden folder that only Personal Vault can use. The app cannot see or access any other files in your Drive.

• Backups are encrypted on your device before upload.
• On your device, the app stores only a "connected" flag and your Google account email address. Authentication tokens are managed by Android and Google Play services, not by us.
• The backup file is stored by Google under your Google account and Google's Privacy Policy. We have no access to it.
• You can disconnect at any time in the app, and revoke access in your Google Account security settings. You can delete the hidden app data from Google Drive's settings ("Manage apps").

Local backups

You can also save an encrypted .pvbackup file to a folder you choose. Scheduled backups run while the app is open. You can protect backups with an optional backup password (derived with PBKDF2); without one, the backup depends on your device's key and may not be restorable on a different device.

App updates and Android vitals

The app checks the Google Play listing to see whether a newer version is available and, if so, shows an update prompt. This check is handled by Google Play.

The app contains no analytics or crash-reporting SDK (no Firebase Analytics, Crashlytics or Sentry). However, if you have opted in on your Android device to share usage and diagnostics data with Google, Google Play may give us aggregated or pseudonymous crash and "app not responding" (ANR) reports, including device model, OS version and stack trace. We use these only to fix bugs. You control this setting in your device's Google settings.

Google ML Kit (text recognition)

Text recognition runs on your device. Images are not uploaded. ML Kit models may be delivered or updated through Google Play services, and Google may collect limited, non-content diagnostic and usage metrics under the ML Kit terms. The app uses the Android system picker for camera and gallery, so it does not request the camera permission.

Sharing, exports and the clipboard

• Sharing. When you share an item through the Android share sheet, you choose the destination app. Once shared, that app's privacy policy applies.
• Exports. You can export to JSON, encrypted JSON, CSV, ZIP or PDF. Only encrypted JSON is protected; other formats can be read by anyone who gets the file. Store and delete exports carefully.
• Clipboard. Copied values are cleared from the clipboard automatically after 30 seconds. Some keyboards or clipboard managers may keep their own history, which we can't control.

Notifications

Reminders and backup notices are local notifications created on your device. No notification data is sent to us or to a push service.

Android permissions

Information processed on our website

Our website is a static site. It has no user accounts, no analytics and no marketing or advertising cookies. Fonts are self-hosted, so your browser doesn't contact third-party font services.

Hosting and server logs

Our hosting provider, Vercel Inc., processes standard server log data when you visit: IP address, browser user agent, requested URL, referrer and timestamp. This is used to deliver the site, keep it secure and protect it against attacks such as DDoS. The provider acts on our behalf and under its own security obligations.

Browser local storage

We store two small values in your browser's local storage. They are never sent to us:

• pv-consent — your privacy/consent choice;
• pv-theme — your light or dark theme preference.

You can clear them at any time in your browser settings. We honour Global Privacy Control (GPC) signals. See our Cookie Policy for details.

When you email us

Our contact page opens your own email app — no form data is sent to our servers. When you email us, we process your email address, name, message content and any attachments in order to reply and help you. Please don't send us passwords, PINs, recovery codes or vault contents; we never need them.

Legal bases for processing

Where the EU GDPR, UK GDPR or similar laws apply, we rely on the following legal bases under Article 6:

• Consent (Art. 6(1)(a)). For ad-related storage and access on your device where consent is required (collected through Google's consent message), and for connecting Google Drive backup. You can withdraw consent at any time in the app, without affecting processing that happened before.
• Contract (Art. 6(1)(b)). To provide features you ask for — processing your Pro purchase, restoring your entitlement, and running backups to the destination you choose.
• Legitimate interests (Art. 6(1)(f)). To keep the free version funded through non-personalised ads (outside regions where consent is required), prevent ad fraud, check for updates, fix crashes using Android vitals, keep our website secure through server logs, and respond to your emails. We have weighed these interests against your rights and keep the data involved to a minimum. You can object at any time.
• Legal obligation (Art. 6(1)(c)). To keep transaction records for tax and accounting, and to respond to lawful requests from authorities.

We do not process special categories of personal data (such as health data). Any such information you store in your vault stays on your device and is not processed by us.

How we share information

We have very little personal information to share in the first place. Where information is processed by others, it falls into these categories:

• Google, as an independent controller or service provider. Google processes data for AdMob (free version), Google Play Billing, Google Play updates and Android vitals, Google Sign-In and Drive, and ML Kit, as described above. Google's use of that data is governed by its own privacy policy.
• Our hosting provider (Vercel Inc.), which processes website server logs on our behalf.
• Our email provider, which stores emails you send us on our behalf.
• Legal requirements. We may disclose information we hold if required by law, court order or a valid request from a public authority, or to protect the rights, safety and security of our users, the public or ourselves. We cannot disclose vault contents because we don't have them.
• Business transfers. If Personal Vault is sold, merged or transferred, the limited information we hold (such as support emails and transaction records) may transfer to the new owner, who must continue to protect it in line with this policy. We will notify you of any such change.

International data transfers

We are based in India. Google and our hosting provider operate globally, so information they process may be transferred to and stored in countries other than yours, including the United States, which may have different data protection laws.

Where such transfers happen, they are protected by recognised safeguards, such as:

• the European Commission's Standard Contractual Clauses (SCCs), which Google and major hosting providers include in their data processing terms;
• the EU-U.S. Data Privacy Framework, and its UK Extension and Swiss-U.S. framework, where the recipient is certified (Google LLC participates);
• for the UK, the International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs;
• for Switzerland, SCCs adapted for the Swiss Federal Act on Data Protection;
• adequacy decisions and other mechanisms recognised by local law, where available.

For your vault, no transfer happens at all — it stays on your device. Google Drive backups are stored in Google's infrastructure in encrypted form under your Google account. Contact us to ask for more information about the safeguards that apply.

Data retention

To delete your data, see Data Deletion.

Security

Personal Vault is designed so your data is protected even if your device is lost:

• The vault database is encrypted with SQLCipher.
• Each item is additionally encrypted with AES-256-CBC and authenticated with HMAC-SHA256.
• A random 256-bit master key is wrapped by a key derived from your PIN using PBKDF2-HMAC-SHA256 with 210,000 iterations. The wrapped key is held in the Android Keystore.
• Your PIN is never stored. Biometric unlock is optional.
• Auto-lock, a privacy overlay in the app switcher, lockout after failed attempts and an optional erase after repeated failed attempts help protect against someone else using your device.
• Backups are encrypted before they leave your device.

Honest limits

Read more on our Security page. To report a vulnerability, email khanmudassir1248@gmail.com.

Your rights and choices

Depending on where you live, you may have the right to:

• Access — know whether we process your personal information and get a copy;
• Delete — ask us to erase it;
• Correct — fix inaccurate information;
• Portability — receive it in a portable format;
• Object or restrict — object to processing based on legitimate interests, or ask us to limit it;
• Withdraw consent — at any time, where we rely on consent;
• Opt out of targeted advertising, sale or sharing (we don't do these, but you can still tell us);
• Complain to a data protection authority.

Controls you already have

• Your vault: view, edit, export and delete everything in the app. Uninstalling the app or clearing its data deletes your local vault.
• Ads: change your ad consent in the app's settings (where offered), reset or delete your Advertising ID in Android settings, or buy Pro to turn the ad SDK off entirely.
• Google Drive: disconnect in the app, delete backups, or revoke access in your Google Account.
• Diagnostics: turn off usage and diagnostics sharing in your device's Google settings.
• Website: clear local storage, or use Global Privacy Control.

See Your Privacy Choices and Data Deletion for step-by-step instructions.

How to make a request

Email khanmudassir1248@gmail.com and tell us what you'd like to do. Because we hold very little about you, most requests will concern emails you've sent us or transaction records from Google Play. For data that Google controls (such as ad data or your Google account), you'll get the fastest result by using Google's own tools. We can't act on vault contents because we don't have access to them.

• Verification. We may ask for information to confirm your identity — for example, that you email from the same address, or that you provide a Google Play order ID. We will never ask for your PIN or vault contents.
• Response time. We acknowledge requests within 3 business days and respond within 30 days, or sooner or later where the applicable law sets a different deadline (for example, 45 days under US state laws, extendable where permitted). We'll tell you if we need more time.
• No charge and no discrimination. Requests are free unless they are clearly unfounded or excessive. We won't treat you differently for exercising your rights.
• Authorised agents. Where the law allows, someone can make a request on your behalf with written permission; we may still need to verify your identity directly.

Region-specific information

The following adds to the rest of this policy for people in specific regions. If there is a conflict, the section for your region applies to you.

European Economic Area, United Kingdom and Switzerland

The EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection (FADP) give you the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, and the right not to be subject to solely automated decisions with legal or similarly significant effects (we make no such decisions).

• Representatives: EU — none appointed; UK — none appointed.
• Ad consent: the app asks for consent through Google's consent message before ad-related device storage or access, as required by the ePrivacy rules and UK PECR.
• Complaints: you can complain to your local supervisory authority — in the EEA, find yours on the EDPB members list; in the UK, the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC). We'd appreciate the chance to resolve your concern first.

United States

California (CCPA as amended by the CPRA)

Notice at collection. The table below lists the categories of personal information collected in the last 12 months in connection with the app and website, including by Google through its SDKs.

• No sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the last 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16.
• Sensitive personal information. We do not collect or use it, so there is nothing to limit. You may still contact us with a request to limit.
• Your rights: to know (categories and specific pieces), delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and not be discriminated against. Use the contact details in Contact us. Authorised agents may submit requests with your signed permission.
• Retention: see Data retention.
• Shine the Light (Cal. Civ. Code 1798.83). We do not disclose personal information to third parties for their own direct marketing purposes.

Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and Nebraska may have the right to confirm and access personal data, correct it (where available), delete it, obtain a portable copy, and opt out of targeted advertising, sale, and profiling in furtherance of significant decisions. We don't sell personal data, conduct targeted advertising or profile you. We honour Global Privacy Control as an opt-out signal on our website.

Appeals. If we decline your request, you can appeal by replying to our decision or emailing khanmudassir1248@gmail.com with "Appeal" in the subject. We will respond within the time required by your state's law (generally 45–60 days). If you disagree with the outcome, you may contact your state Attorney General.

Nevada

We do not sell covered information as defined under Nevada law. You may still submit an opt-out request to khanmudassir1248@gmail.com.

Washington (My Health My Data Act) and similar laws

We do not collect, process or share consumer health data. Any health information you choose to store in your vault stays encrypted on your device and is never received by us.

Children (COPPA)

The app is not directed to children under 13, and we do not knowingly collect personal information from them. See Children's privacy.

Canada

Under PIPEDA and applicable provincial laws, you can access and correct your personal information and withdraw consent, subject to legal limits. For Quebec (Law 25), the person in charge of the protection of personal information is Mudassir Khan, reachable at khanmudassir1248@gmail.com. Information may be processed outside Quebec and Canada as described in International data transfers. You may complain to the Office of the Privacy Commissioner of Canada (OPC) or, in Quebec, the Commission d'accès à l'information.

Brazil

Under the LGPD (Lei Geral de Proteção de Dados), Article 18 gives you the rights to confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with consent, information about sharing, information about the possibility of refusing consent and its consequences, and revocation of consent. You may also petition the Autoridade Nacional de Proteção de Dados (ANPD).

India

We are established in India. Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable rules, you (as a "data principal") have the right to access information about your personal data, correction and erasure, grievance redressal, and to nominate another person to exercise your rights in the event of death or incapacity. Where we rely on consent, you can withdraw it as easily as you gave it, including through a registered consent manager where applicable.

Grievance Officer: Mudassir Khan, email khanmudassir1248@gmail.com. We acknowledge grievances within 3 business days and resolve them within the time required by law. If you are not satisfied, you may complain to the Data Protection Board of India after exhausting this grievance process.

Japan

Under the Act on the Protection of Personal Information (APPI), you can request disclosure, correction, suspension of use, deletion, and suspension of third-party provision of retained personal data. Information handled by Google may be processed in the United States and other countries; Google maintains safeguards consistent with APPI standards. You may contact the Personal Information Protection Commission (PPC).

South Korea

Under the Personal Information Protection Act (PIPA), you can request access, correction, deletion, suspension of processing and withdrawal of consent. Overseas transfer: ad, billing, backup and diagnostic data described above is transferred to Google LLC (United States and other countries where Google operates), over the network when you use those features, for the purposes and retention periods described in this policy. You can refuse by not using the relevant features (for example, by buying Pro to disable ads or not connecting Google Drive). Where required by law, we will designate a domestic agent and publish their details here. You may contact the Personal Information Protection Commission (PIPC) or the KISA privacy centre.

China (mainland)

The app relies on Google Play and Google services and may not be distributed in mainland China. If you use it there, the Personal Information Protection Law (PIPL) gives you rights to know, decide, restrict, refuse, access, copy, port, correct, delete and have processing rules explained. Information processed by Google may be transferred outside mainland China. Contact us to exercise your rights.

Singapore

Under the Personal Data Protection Act (PDPA), you can request access to and correction of your personal data and withdraw consent. You may contact the Personal Data Protection Commission (PDPC).

Thailand

Under the Personal Data Protection Act B.E. 2562 (PDPA), you have rights to access, portability, objection, erasure, restriction, correction and withdrawal of consent. You may complain to the Personal Data Protection Committee (PDPC).

Philippines

Under the Data Privacy Act of 2012, you have rights to be informed, access, object, erasure or blocking, rectification, portability and damages. You may complain to the National Privacy Commission (NPC).

Vietnam

Under Decree 13/2023/ND-CP on personal data protection and the Personal Data Protection Law, you have rights to be informed, consent and withdraw consent, access, delete, restrict and object to processing, and to complain. Data processed by Google may be transferred abroad as described above. The competent authority is the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.

Indonesia

Under Law No. 27 of 2022 on Personal Data Protection (PDP Law), you have rights to information, access, correction, deletion, withdrawal of consent, objection to automated decisions, and portability. Complaints may be made to the competent data protection authority.

Malaysia

Under the Personal Data Protection Act 2010 (as amended), you can request access to and correction of your personal data, withdraw consent and, where available, request portability. You may contact the Personal Data Protection Commissioner.

Australia and New Zealand

In Australia, the Privacy Act 1988 and the Australian Privacy Principles (APPs) let you access and correct your personal information. Information processed by Google may be held overseas, including in the United States. If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (OAIC).

In New Zealand, the Privacy Act 2020 gives you rights to access and correct your personal information. You may complain to the Office of the Privacy Commissioner.

South Africa, Nigeria and Kenya

• South Africa (POPIA): rights to access, correction, deletion, objection and to complain to the Information Regulator.
• Nigeria (Nigeria Data Protection Act 2023): rights to information, access, rectification, erasure, restriction, portability, objection and withdrawal of consent; complaints to the Nigeria Data Protection Commission (NDPC).
• Kenya (Data Protection Act 2019): rights to be informed, access, object, correction, deletion and portability; complaints to the Office of the Data Protection Commissioner (ODPC).

Middle East and Türkiye

• United Arab Emirates (PDPL, Federal Decree-Law No. 45 of 2021): rights to access, portability, correction, erasure, restriction and objection. Residents of free zones such as DIFC or ADGM may have rights under those zones' data protection laws.
• Saudi Arabia (PDPL): rights to be informed, access, request correction and destruction of personal data. Complaints may be made to the Saudi Data & AI Authority (SDAIA). Transfers outside the Kingdom rely on safeguards permitted by the PDPL and its transfer regulations.
• Qatar (Law No. 13 of 2016) and Bahrain (Law No. 30 of 2018): rights to access, correction, erasure and objection; complaints to the competent national authority.
• Israel (Protection of Privacy Law): rights to access and correct information held about you; complaints to the Privacy Protection Authority.
• Türkiye (KVKK, Law No. 6698): rights under Article 11, including to learn whether data is processed, request information, correction, deletion, and object. Where the law requires, we or Google rely on your explicit consent or approved safeguards (such as standard contracts) for transfers abroad. Complaints may be made to the Personal Data Protection Authority (KVKK Kurumu).

Latin America

• Mexico (LFPDPPP): ARCO rights — access, rectification, cancellation and opposition — and revocation of consent. Contact us to exercise them; you may also contact the competent federal data protection authority.
• Argentina (Law 25,326): rights of access, rectification and deletion; the Agency for Access to Public Information (AAIP) handles complaints.
• Colombia (Law 1581 of 2012): rights to know, update, rectify and delete data and revoke authorisation; complaints to the Superintendence of Industry and Commerce (SIC).
• Chile (Law 19,628, as amended by Law 21,719): rights of access, rectification, deletion, objection and portability.
• Peru (Law 29733): ARCO rights; complaints to the National Authority for Personal Data Protection.

Sanctioned regions

The app may not be offered in countries or regions where distribution is restricted by sanctions or where Google Play services are unavailable.

Everywhere else

Wherever you live, we apply the protections described in this policy, and you can contact us to access, correct or delete information we hold about you.

Children's privacy

Personal Vault is not directed to children. You must be at least 13 years old (or the higher minimum age that applies in your country) to use it. We do not knowingly collect personal information from children under 13.

In the EEA, users under 16 (or the lower age set by national law) need a parent or guardian's consent where consent is required for ad-related processing. Similar parental-consent rules apply to minors in other regions, such as India's DPDP Act for users under 18.

If you believe a child has sent us personal information, contact khanmudassir1248@gmail.com and we will delete it.

Third-party links and services

The app and website link to or rely on third-party services, including Google Play, Google Drive, Google Sign-In, Google AdMob and Google ML Kit. Ads may also link to advertisers' websites or apps. We don't control these services and aren't responsible for their privacy practices. Please read their policies, starting with the Google Privacy Policy.

Items you import from, or share and export to, other password managers or apps are subject to those services' own policies once they leave Personal Vault.

Changes to this policy

We may update this policy when the app, the website or the law changes. The "Last updated" date at the top shows when it last changed.

If we make material changes — for example, adding a new type of data processing, analytics, or a new third-party service — we will notify you in the app and on this website before the change takes effect, and ask for your consent where the law requires it. Continuing to use Personal Vault after a change means the updated policy applies.

Contact us

For questions, requests or complaints about privacy, contact:

We acknowledge messages within 3 business days and respond to privacy requests within the time required by law. You can also reach us through our contact page.