VaultIt privacy policy
Short version: your photos, videos, documents, pattern and recovery phrase never leave your phone. We have no account system and no server that could hold them. The only data that leaves the device is anonymous usage counts and the purchase records Google Play and RevenueCat keep when you buy Pro.
1. What stays on your device
Everything you put in the vault, and everything needed to open it:
- your photos, videos and documents, encrypted with AES-256-GCM
- your pattern and recovery phrase, used to derive the encryption key with Argon2id
- the key material itself, held in memory only while the vault is unlocked
- an index of what is in each vault
There is no account, no sign-in and no sync service. We cannot read your files, and we cannot reset your pattern. The 12-word recovery phrase is the only way back if you forget the pattern — that is a property of the encryption, not a policy choice.
Backups you make are yours. "Back up" writes one encrypted .vaultbackup file
to a location you choose in Android's own save dialog. If you pick Google Drive or
another folder, the file goes to that provider — encrypted, so the provider sees
ciphertext, not your photos. We are not involved in that transfer and never receive
a copy.
2. What leaves your device
The app sends a small number of event names to Aptabase, an analytics service:
| Event | When |
|---|---|
onboarding_step |
you move through the first-run screens |
aha_seen |
you reach the "now it is just noise" step |
paywall_shown |
the Pro screen is shown |
purchase |
a purchase completes, with the plan name |
backup_done |
a backup finishes |
Each event carries only that name and small properties such as which plan or which step. They never include file names, file counts, folder names, your pattern, your recovery phrase, or any content. Aptabase does not set a persistent device identifier for this app.
These counts are always on; there is no setting to turn them off. They show us which screens people reach so we can improve the app, and nothing in them identifies you or your files.
Purchases
Pro is sold through Google Play. When you buy, Google Play processes the payment and RevenueCat (our subscription-management provider) records an anonymous app user id and what you bought, so the app can restore your purchase on a new phone. We never see your name, card or address. Google's and RevenueCat's own privacy policies govern that processing.
Three purchase options exist, and the app shows the exact price from the store before you confirm:
- Lifetime — one payment, no renewal
- Yearly — an auto-renewing subscription with a 7-day free trial
- Monthly — an auto-renewing subscription
Subscriptions renew automatically through Google Play until you cancel; you cancel in the Play Store, not in the app. Nothing you already stored is ever locked if a plan ends or a trial is not converted — the free tier limits only adding more.
Play in-app review
After your first seal, the app may ask the Play Store to show its review prompt once. That prompt is drawn and submitted by Google Play, not by us; we receive only aggregate ratings and never know who wrote a review.
3. Permissions and why
These are the permissions in the shipped release build. The first three we ask for ourselves and only use when you trigger the feature. The rest are declared by the libraries the app is built on, and are listed because you deserve to know they are there.
| Permission | Why |
|---|---|
CAMERA |
take a photo or video straight into the vault; asked only when you open the camera |
RECORD_AUDIO |
record sound with a video; asked only when you switch to video, never in photo mode |
USE_BIOMETRIC |
unlock with your fingerprint instead of the pattern; only if you turn it on in Settings |
USE_FINGERPRINT |
the older name for the same fingerprint capability, for Android 9 and below |
INTERNET, ACCESS_NETWORK_STATE |
talk to Google Play and RevenueCat when you buy or restore Pro; also used by the analytics described in section 2 |
com.android.vending.BILLING |
let Google Play process a purchase |
WRITE_EXTERNAL_STORAGE (Android 9 and below only) |
save a captured photo when running on an old Android version |
READ_EXTERNAL_STORAGE |
the read counterpart of the line above, on old Android versions |
WAKE_LOCK |
keep the screen on while a video plays |
com.aman.vaultit.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION |
an internal Android permission, not one you grant; it limits broadcast receivers to this app |
Photo and file picking uses Android's system picker and the Storage Access Framework. The app reads only the files you select. Nothing in the app scans your gallery, contacts, location or clipboard.
4. Children
The app is not directed at children and is intended for users aged 18 and over.
5. Your choices and rights
- Delete everything — uninstall the app, or use Android's "clear storage". This destroys the encrypted vault and its key; because we hold no copy, this is irreversible. Back up first if you want to keep the files.
- Export — copy any file back out to your gallery or Downloads at any time, free.
- Purchases — manage or cancel subscriptions in the Play Store; restore them in the app.
Because we never receive your vault contents, there is nothing on our side to export or erase — the usual data-subject request has nothing to act on.
6. Changes
If this policy changes, the new version ships with the app and is posted at vaultit.app.
7. Contact
Questions about this policy or your data: amantwd@gmail.com.