Vaults — Privacy Policy (Android)
Vaults — Privacy Policy (Android)
Effective date: May 20, 2026
This Privacy Policy explains how the Vaults Android app (“Vaults,” “the app,” or “we”) handles information when you use the app published on Google Play as package jsd.vaults.paid.
Vaults is a password manager that stores your vault data primarily on your device. Some features connect to third-party services (Google and subscription providers). This policy describes what is stored locally, what may be sent externally, and what choices you have.
Please also read our Terms of Use.
1. Overview
Most of your password and vault information stays on your Android device. We do not operate a Vaults cloud database for your passwords.
Information may leave your device when you:
- Back up or restore data with Google Drive (subscription required)
- Buy or restore a Cloud Backup subscription through Google Play, validated with RevenueCat
- Sign in with Google for Drive backup features
- Open external links (for example legal pages, Google Play subscription settings, or email)
- Share a backup file using Android’s share sheet
Vaults does not include advertising SDKs and does not show third-party ads in the app.
2. Data Stored Locally on Your Device
Vaults stores the following on your device:
- Password entries — usernames, emails, passwords, notes, titles, websites, and related sensitive fields are encrypted in a local SQLite database (secure_vault.db); site names, favorites, and related metadata may remain visible so the app can organize vaults
- Vault information — vault names, descriptions, lock state, and creation dates
- Vault PIN protection — vault PINs are verified with salted PBKDF2 verifier records and are not stored as plain text
- App settings and state — for example security option (biometric / dial), app lock preferences, onboarding flags, password generator settings, locked-vault state, and similar preferences using Android local storage (SharedPreferences)
- Local encryption material — a random device data key and PIN verifier records stored with platform secure storage; PIN verifier records use PBKDF2 data and are used to verify the PIN, not to store the PIN as plain text
- Subscription cache — whether Cloud Backup is active, plan type, expiry, and last validation time (cached locally for offline use)
Your entry passwords and notes are encrypted inside the local database using a device data key stored with platform secure storage. Your app/vault PIN is verified with a PBKDF2 verifier and is not stored as plain text. Protecting your device (screen lock, biometrics) and remembering your PIN remain important.
Local backup files (for example .vault or .csv) are created on your device when you use backup or export features. New .vault backups use encrypted backup envelopes. If you choose a backup PIN, the backup is protected with PBKDF2-HMAC-SHA256 and AES-256-GCM using that PIN. If you skip the backup PIN, Vaults still writes an app-managed encrypted backup envelope that can be restored by the app without asking for a backup PIN.
3. Account and Login Data
Vaults does not require a separate Vaults username or password account.
If you use Cloud Backup, you sign in with a Google account through Google Sign-In. Google may provide us (through the sign-in flow) information such as your name, email address, and profile image, depending on your Google account settings and what Google shares with the app. We use this only to enable Google Drive backup and restore and to show which account is signed in (for example in Settings).
Google authentication tokens are used so the app can access Google Drive on your behalf. Tokens are handled by Google’s SDKs and are not stored by us on our own servers (we do not run Vaults backend servers for your passwords).
4. Files, Documents, or User Content
You control the files Vaults accesses:
- Restore from file — you pick a .vault or .csv file through the system file picker. The app reads only the file you select.
- Local backup / export — the app writes backup or export files to storage locations allowed by Android (for example app documents or a path you choose when sharing).
- Share — if you share a backup, Android’s share sheet sends the file to the app or destination you choose. We do not receive that file on our servers.
All vault content you save in the app is user-provided. You are responsible for what you store and for keeping backup files and PINs safe.
5. Cloud Backup / Sync / Server Storage
Google Drive (optional, subscription required)
With an active Cloud Backup subscription, you can upload a backup file to a folder named Vaults Backup in your Google Drive. The backup contains your vault data (tasks/sites) inside Vaults backup format. New .vault backups are encrypted either with the backup PIN you choose or with app-managed encryption when you skip the backup PIN.
That file is stored in your Google Drive account under Google’s terms and privacy policy. We do not host your password database on our own servers.
Restore from Drive downloads the backup file you select from your Drive folder back to the app for processing on your device.
There is no continuous real-time sync of individual passwords to the cloud—only backup and restore actions you initiate (or that the app performs as part of those flows).
6. In-App Browser / WebView
Vaults does not embed a general in-app WebView browser for browsing the web.
Legal links, Google Play subscription management, and similar URLs are opened in your default browser or system UI (via the device’s link handler). Those sites may collect information under their own policies when you visit them.
7. Text-to-Speech / Speech / AI Processing
Vaults does not use text-to-speech, speech recognition, or AI processing services to handle your vault content.
8. Purchases and Subscriptions
Cloud Backup subscriptions are sold through Google Play (monthly and yearly plans shown in the app as Cloud Backup Monthly and Cloud Backup Yearly).
The app uses RevenueCat (purchases_flutter) to:
- Load subscription products and prices from Google Play
- Process purchases and restores
- Check whether the Vaults Pro entitlement is active
- Cache subscription status on your device
Google Play handles payment information (for example payment method and billing records). RevenueCat receives purchase and subscription-related identifiers and status needed to validate your entitlement. RevenueCat’s handling of data is described in RevenueCat’s Privacy Policy.
We do not receive your full payment card number through Vaults.
9. Analytics, Crash Reports, and Diagnostics
Vaults does not integrate Firebase Analytics, Firebase Crashlytics, or other third-party analytics or crash-reporting SDKs in the app codebase.
The app may write debug or error messages to the device log on your phone (for example through the app’s logger in development or error paths). Those logs stay on your device unless you or a tool you use collects them. We do not operate a Vaults server that automatically receives those logs.
Some preference keys (for example onboarding prompt timing) are stored locally for app behavior; they are not sent to our servers as analytics.
10. Advertising and Tracking
Vaults does not display ads and does not use AdMob or other advertising SDKs.
The Android manifest for Vaults does not request the advertising ID permission.
We do not use Vaults to track you across other companies’ apps or websites for advertising purposes.
11. Permissions
Vaults declares the following Android permissions:
- INTERNET — connect to Google Play billing, RevenueCat, Google Sign-In, and Google Drive when you use those features
- ACCESS_NETWORK_STATE — check whether network connectivity is available for billing, RevenueCat, Google Sign-In, Google Drive, and legal links
- USE_BIOMETRIC / USE_FINGERPRINT — unlock the app or vaults with fingerprint or face unlock where your device supports it (biometric data is processed by Android, not sent to us)
- com.android.vending.BILLING — in-app subscriptions through Google Play
Opening files uses the system file picker; Vaults does not declare broad storage permissions in its manifest for routine access. File access is limited to files you choose.
12. Clipboard
When you tap copy in the app (for example on a password, username, note, or generated password), Vaults copies that value to your device clipboard so you can paste it elsewhere.
Other apps on your device may be able to read the clipboard depending on your Android version and settings. Clear the clipboard or avoid copying sensitive values if you share your device.
13. Third-Party Services
Vaults relies on these third parties when you use related features:
- Google Play — app distribution and subscription billing
- RevenueCat — subscription validation and restore
- Google Sign-In and Google Drive APIs — optional cloud backup and restore
- Google (OAuth / APIs) — authentication and file storage in your Drive account
Each provider has its own privacy policy and practices. We encourage you to review:
14. Data Sharing
We do not sell your vault passwords or entries.
Information may be shared only in these situations:
- With service providers — Google and RevenueCat, as needed to provide sign-in, Drive backup, and subscriptions (under their policies)
- With Google Drive — when you upload a backup file to your Drive account
- When you share — when you use Android share or export to send a file to another app or person
- Legal requirements — if required by law or to protect rights, safety, or security where applicable
15. Data Retention
On your device: Vault data remains until you delete entries, delete the app, clear app storage, or use Factory Reset in Settings (which erases app data on the device).
Subscription cache: Cached entitlement data is kept in local storage until updated, cleared, or removed when you clear app data.
Google Drive: Backup files remain in your Google Drive until you delete them in Drive or through restore flows that replace files.
Google Play / RevenueCat: Purchase records are retained according to Google’s and RevenueCat’s policies.
16. Data Deletion
You can delete your data in several ways:
- Delete individual entries or vaults inside the app
- Use Factory Reset in Settings to erase local app data on the device
- Uninstall Vaults or clear app storage in Android system settings
- Delete backup files in Google Drive (folder Vaults Backup) or on your device
- Cancel your subscription in Google Play (this stops billing but does not by itself delete Drive backups or local data)
- Sign out of Google in the app to remove the active Google session used for Drive features
Deleting the app from your device does not delete files already stored in Google Drive or cancel an active Google Play subscription.
17. Children’s Privacy
Vaults is not directed at children under 13, and we do not knowingly collect personal information from children under 13 through a dedicated children’s registration flow. If you believe a child has provided personal information in connection with the app, contact us and we will take reasonable steps to address the request.
18. Security
We design Vaults to keep vault data on your device and to use industry-standard tools for backup encryption (when you enable a backup PIN or use app-managed encrypted backups), vault PIN verification, local database encryption, and secure communications (HTTPS) with Google and subscription services.
No method of storage or transmission is completely secure. You are responsible for your device security, vault PINs, backup PINs, and Google account security.
19. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will change the effective date at the top of this page. Continued use of Vaults after an update means you accept the revised policy.
20. Contact
If you have questions about this Privacy Policy or Vaults on Android, contact us at:
Email: jsd.application@gmail.com