Legal · Privacy Policy

SecureVault
Privacy Policy

EFFECTIVE DATE: JUNE 2, 2026  ·  VERSION 1.0  ·  ANDROID

SecureVault is a local-first, offline-only application. This Privacy Policy explains how SecureVault handles your data. The short answer: your data never leaves your device. No accounts. No cloud. No tracking. No servers.

01 · Overview

SecureVault is a password manager and encrypted vault for Android. It is designed from the ground up to store your sensitive credentials — passwords, API keys, seed phrases, and private notes — entirely on your device, encrypted and inaccessible to anyone without your master password.

We do not operate servers, analytics infrastructure, or data pipelines. There is no "our servers" to send your data to.

02 · Data We Collect

SecureVault collects no personal data. All information you enter into the app is stored locally on your Android device and is never transmitted anywhere.

Data Type Collected? Where It Goes
Vault entries (passwords, keys, seeds) ✗ Never sent Encrypted locally only
Master password ✗ Never stored Used only to derive encryption key in memory
Biometric data ✗ Never accessed Handled entirely by Android OS
Device identifiers ✗ Not collected
Usage analytics / crash logs ✗ Not collected
Location ✗ Not accessed
Camera / microphone ✗ Not used

03 · Encryption & Security Model

All vault data is encrypted on-device before being written to storage. The encryption is applied to sensitive fields individually and to additional category-specific data as an encrypted JSON payload.

KEY DERIVATION · PBKDF2WithHmacSHA256 Iterations · 100,000 Key length · 256 bits Salt · 32 bytes (random, per-vault) ENCRYPTION · AES/GCM/NoPadding IV size · 12 bytes Auth tag · 128 bits Storage format · Base64-encoded ciphertext in Room DB

The master password is never stored anywhere — not on disk, not in memory beyond the active session. It is used solely to derive the vault encryption key via PBKDF2. If you forget your master password, vault data cannot be recovered.

AES-256-GCM PBKDF2-HMAC-SHA256 Local Room DB AndroidX Biometric (OS-level) No cloud backup No network requests

04 · Local Data Storage

Vault records are stored in a Room (SQLite) database in the app's private internal storage directory. This directory is not accessible to other apps on non-rooted devices.

App settings (theme, auto-lock interval, biometric preference, clipboard timer) are stored using DataStore Preferences — also local and private.

Clearing all data from Settings permanently removes all vault records and resets the app to its initial state. This action is irreversible.

05 · Third-Party Services

SecureVault uses no third-party SDKs, analytics tools, advertising networks, or crash-reporting services. No data is shared with any third party under any circumstances.

No Firebase / Analytics No Ads / AdMob No Crashlytics No cloud sync No external APIs

06 · Android Permissions

SecureVault requests only the minimum permissions necessary for its core features.

Permission Purpose
USE_BIOMETRIC Fingerprint / face unlock support (optional). Biometric data never leaves the Android OS.
USE_FINGERPRINT Legacy biometric API compatibility (Android 8+).
VIBRATE Haptic feedback on UI interactions.

The app does not request INTERNET, ACCESS_NETWORK_STATE, READ_CONTACTS, READ_EXTERNAL_STORAGE, CAMERA, or any other sensitive permissions.

07 · Children's Privacy

SecureVault is not directed at children under the age of 13. We do not knowingly collect any information from children. Since the app collects no data at all, no personal information from any user — child or adult — is ever transmitted or stored outside the device.

08 · Your Rights & Data Control

Because all data is stored locally on your device, you have complete control at all times:

· Edit or delete any vault entry at any time from within the app.
· Use "Clear All Data" in Settings to permanently wipe all vault records.
· Uninstall the app to remove all associated data from your device.
· No account deletion request is needed — there is no account.

09 · Changes to This Policy

If this Privacy Policy is updated, the new version will be published at this URL with an updated effective date. Material changes that affect data handling will be communicated through the app's update notes on Google Play.

10 · Contact

Questions about this Privacy Policy? Contact the developer:

Developer: Osvald Studio
Email: osvald.studio26@gmail.com
App: SecureVault — Password Manager
Package: com.vault.securevault