XVault Password Manager Privacy Policy
The short version
XVault is an offline vault. Everything you store stays on your device, encrypted. The app has no internet access, so we cannot collect, receive, sell or share your data. We have no servers, accounts, analytics or ads.
What XVault stores
You choose what to put in the vault, for example passwords, Aadhaar, PAN, card, bank, passport, licence and Wi-Fi details, notes, and photos or scans you attach. This information:
- is encrypted on your device with AES-256-GCM before it is saved;
- is unlocked with your master password, which is never stored (only a protected key derived from it is);
- never leaves your device unless you choose to export a backup (see "Backups").
We cannot see, read or recover your data. If you forget your master password, your vault cannot be opened and we cannot help recover it.
Information we collect
None. XVault does not collect, transmit or share personal information. The app does not request the internet permission.
XVault does not include advertising, analytics, tracking, crash-reporting or other third-party SDKs that send data anywhere.
Permissions the app uses
| Permission | Why |
|---|---|
| Biometric / fingerprint | Optional. Lets you unlock with your fingerprint. Biometric data is handled by Android; XVault never receives or stores it. |
| Notifications | Optional. Shows a reminder when a card, passport or licence you saved is about to expire. The notification does not show item names. |
| Vibrate | Device feedback. |
The background-reminder component also declares network-state, wake-lock, boot-completed and foreground-service permissions. These are used only to schedule the daily expiry check on your device. XVault does not use them to go online.
PIN and fingerprint unlock
If you turn on PIN or fingerprint unlock, a protected copy of your vault key is stored on your device, locked by the Android Keystore. After 5 wrong PIN attempts the PIN is erased and you must use your master password. You can turn these off at any time in Settings.
Backups
Backups are optional and started only by you. When you choose "Export encrypted backup":
- XVault creates a file encrypted with a password you choose for that backup;
- you pick where to save it using Android's file picker, which can include Google Drive or another storage provider you have installed;
- the file is stored by that provider under their privacy policy. Because it is encrypted, the provider cannot read its contents without your backup password.
XVault does not upload anything itself. Android's own cloud backup and device-transfer features are turned off for this app.
Clipboard
When you copy a password or other detail, it is placed on the clipboard. XVault clears it after the delay you choose (default 30 seconds) and when the vault locks, if it is still unchanged. Other apps may be able to read the clipboard while the item is on it.
Screenshots
By default, XVault blocks screenshots and screen recording and hides its contents in the recent-apps view. You can change this in Settings.
Data retention and deletion
Your data is kept on your device until you delete it. You can:
- delete individual items (they stay in Trash for 30 days, then are permanently removed);
- choose "Erase vault & start over" in Settings to delete everything and its keys;
- uninstall the app, which removes all its data from your device.
Backup files you exported are outside the app. Delete them from where you saved them.
Children
XVault is not directed at children under 13, and we do not knowingly collect any information from anyone.
Security
XVault uses AES-256-GCM encryption, a password-based key derivation with 600,000 iterations, Android Keystore protection for PIN and fingerprint unlock, auto-lock, and screenshot blocking. No system is perfectly secure. Choose a strong, unique master password and keep your device updated and protected with a screen lock.
Changes to this policy
If this policy changes, we will update the date above and publish the new version at the same address. Material changes will also be noted in the app's release notes.
Contact
Questions about this policy: akhil6169@gmail.com