PRIVACY POLICY

Your data stays
on your device.

SecureVaultX is a local-first password manager. We have no servers, no accounts, and no way to access your vault — by design.

EFFECTIVE June 2026
VERSION 1.0
PACKAGE com.veyoraa.securevaultx
TL;DR — THE SHORT VERSION
No data collected or uploaded
No accounts or sign-up required
No analytics or tracking SDKs
No third-party data sharing
AES-256 encryption on device
Biometrics stay on your device
01 Overview
WHO WE ARE

SecureVaultX is an independent Android application for storing passwords, notes, and files securely on your device. The app is developed and maintained as a solo project.

This Privacy Policy explains what information the app accesses, how it is used, and — most importantly — what we never do with it.

02 Data the app accesses
Data type Purpose Uploaded? Stored
Passwords & usernames Core vault functionality NEVER LOCAL ONLY
Secure notes Note storage NEVER LOCAL ONLY
Files & attachments Drive vault feature NEVER LOCAL ONLY
Biometric data Unlock authentication NEVER OS keystore only
Device storage Backup export / import NEVER User-chosen location
03 What we never do
🚫
No data collection
We do not collect, transmit, or store any of your vault data on external servers. There are no servers.
📊
No analytics or crash reporting
SecureVaultX contains no analytics SDKs (no Firebase, no Crashlytics, no Amplitude). Crashes are not reported anywhere.
🤝
No third-party sharing
We do not share, sell, rent, or trade your data with any third party under any circumstances.
☁️
No cloud sync
The app has no cloud sync feature. Backup files are created locally and shared only when you explicitly trigger an export.
👤
No accounts required
SecureVaultX requires no account creation, no email address, and no personal information to use.
04 Encryption & security
🔐
AES-256 encryption at rest
All vault data — passwords, notes, and files — is encrypted using AES-256 before being written to device storage. Keys are derived from your master password and stored in the Android Keystore.
👆
Biometric authentication
Fingerprint and face authentication are handled entirely by the Android BiometricPrompt API. Biometric data never leaves the device's secure enclave and is never accessible to the app.
🔑
PBKDF2-SHA256 PIN hashing
Passcodes are hashed using PBKDF2-SHA256 with 600,000 iterations — meeting OWASP 2023 minimums — processed in a background isolate to prevent brute-force attacks.
📸
Screenshot protection
FLAG_SECURE is applied by default, preventing screenshots, screen recording, and app-switcher previews of vault content.
05 Android permissions
Permission Why it's needed
USE_BIOMETRIC Fingerprint / face unlock via Android BiometricPrompt
USE_FINGERPRINT Compatibility with older Android versions
READ/WRITE_EXTERNAL_STORAGE (≤ Android 10) Backup export to Downloads on legacy devices only
READ_MEDIA_* File picker for importing backup files
VIBRATE Haptic feedback on passcode input
RECEIVE_BOOT_COMPLETED / WAKE_LOCK / FOREGROUND_SERVICE / FOREGROUND_SERVICE_DATA_SYNC Automatic Backup (Pro) scheduling and running as a background service, including after a reboot
POST_NOTIFICATIONS Shows the "Backing up your vault…" progress notification while Automatic Backup runs
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS Lets Automatic Backup (Pro) run reliably in the background if you opt in
INTERNET Google Fonts (loaded at build time, not runtime) and Google Play Billing for Pro and coffee-tip purchases
06 Backup files
EXPORT

When you export a backup, the app creates an encrypted .svx file protected by a password you choose. This file is saved locally via the Android share sheet — you decide where it goes (Downloads, Google Drive, etc.). We never receive a copy.

IMPORT

When you import a backup, the file is decrypted on-device using the password you provide. No data is transmitted during this process.

AUTOMATIC BACKUP (PRO)

If you enable Automatic Backup, encrypted backup files are created on a schedule and saved directly to a local folder on your device (Download/SecureVaultX). You can choose what's included (everything, passwords & notes only, or excluding videos) in Settings → Automatic Backup → Backup Content. This happens entirely on-device — no backup file, encrypted or otherwise, is ever uploaded anywhere by us.

07 In-app purchases
PRO — ONE-TIME PURCHASE

The Pro upgrade (one-time payment) unlocks App Disguise and Automatic Backup together, processed entirely through Google Play Billing. SecureVaultX never handles payment information directly. We receive only a confirmation that a purchase was made — no card, bank, or payment details.

BUY ME A COFFEE — OPTIONAL TIPS

SecureVaultX also offers optional, repeatable tip purchases (Small/Medium/Large "coffee") through the same Google Play Billing system. These are entirely separate from Pro: tipping unlocks no feature and is never required. Each tip is a standalone, one-time, re-purchasable transaction — you can tip more than once if you'd like.

REFUNDS

Refunds for both Pro and coffee-tip purchases are handled entirely by Google Play under their standard refund policy — the developer does not process or control refunds directly. Contact Google Play support within 48 hours of purchase for refund requests.

08 Data retention & deletion
HOW LONG DATA IS KEPT

Because all vault data lives only on your device, it is retained for as long as you keep it there — there is no remote copy for us to retain or delete on your behalf.

HOW TO DELETE YOUR DATA

You can permanently delete individual passwords, notes, or files at any time from within the app. To erase everything at once, use the "Delete All Data" option in Settings, or simply uninstall the app — since nothing is stored outside your device, uninstalling removes all vault data completely and immediately.

09 Your rights & choices

Because SecureVaultX collects no personal data on any server, most data-protection rights (such as those under GDPR or the CCPA/CPRA) that concern requesting a copy of, correcting, or deleting data held by a company simply don't apply here — there is no copy held by us to request, correct, or delete.

In practical terms, you already have full and immediate control on-device: you can view, export, correct, or delete any password, note, or file at any time directly within the app, without needing to contact us.

10 Children's privacy
COPPA / CHILDREN UNDER 13

SecureVaultX is not directed at children under the age of 13. We do not knowingly collect any information from children. Since the app collects no data from anyone, this applies equally to all users.

11 International use

SecureVaultX can be used anywhere Google Play distributes it. Because your vault data never leaves your device, there is no cross-border data transfer to disclose — your data stays in the country your device is physically in, at all times.

12 Changes to this policy
UPDATES

If this policy changes materially, the updated version will be posted at this URL (and bundled with the next app update) with a new effective date. Continued use of the app after changes constitutes acceptance. Since we collect no data, changes are unlikely to affect your privacy in practice.

13 Governing law

This policy is governed by the laws of India, without regard to conflict-of-law principles, without prejudice to any mandatory data-protection rights you may have under the law of your own country of residence.

14 Contact
✉️

Questions about this policy?

If you have any questions or concerns about this Privacy Policy or how SecureVaultX handles your data, reach out and we'll get back to you.

support@veyoraa.in