Privacy Policy

Effective from the date this file was last changed in the repository's history.

PP Vault is a vault that lives on your device. This policy is short because the honest answer to most questions a privacy policy exists to answer is "nothing" and "nobody".

What we collect

Nothing.

PP Vault has no accounts, no server, no analytics and no crash reporting. The app does not know who you are, and there is no channel through which anything you store, type or do could reach us. We cannot see your data, lose your data, sell your data or be compelled to hand it over, because we never have it. That is unchanged and it is the point.

Advertising, on the free Android version

The free Android version shows a banner from Google AdMob on two screens: the grid of folders a vault opens on, and the list inside a folder. It appears nowhere else, and in particular never on a screen where a password is being entered or where anything out of a vault is shown. PP Vault Pro has no advertising and does not include the SDK's permissions in what it uses.

The banner refreshes while one of those screens is open, which means an ad request roughly once a minute rather than one per visit. It stops when the screen does: leaving the folder screens, or leaving the app, stops the requests.

Google receives what it receives for any ad request: an advertising identifier, the device model and language, and an approximate location derived from the IP address the request came from. It does not receive anything from a vault, because nothing in the app hands it anything: the ad view is given a screen position and nothing else. Google's own policy governs what it then does, and it is at policies.google.com/technologies/ads. You can reset or delete the advertising identifier in Android's own settings, under Privacy, and the ad still loads without it.

The iPhone app and the browser extension have no advertising and no ad SDK.

What stays on your device

Everything you put in the vault: your photograph, your files, notes, logins and authenticator codes, your picture password, and the app's own counters. All content is encrypted with AES-256-GCM before it is written; on Android the sealing key lives in the Android Keystore (StrongBox where the phone has it) and on iOS behind the Secure Enclave, in both cases marked so it cannot leave the device it was made on. In the browser extension the key is a non-extractable browser key. core/SECURITY.md in the repository describes the design in full, including its limits, and is the authoritative version.

Backups

Backups are files you create, encrypted with AES-256-GCM under a key derived from your seventeen-word recovery phrase before they leave the app. They are written where you choose to put them. If you copy a backup to a cloud drive, that drive's operator holds ciphertext we cannot read and neither can they; their handling of the file is governed by their policy, not this one.

If a future version adds upload to storage you supply (such as your own R2 bucket), the same applies: the bucket receives only ciphertext, the credentials you enter are stored encrypted on your device and are never placed inside a backup, and the feature is off until you configure it.

Permissions

• Photos or file access is used when you pick your vault picture or add a file, on the occasion you pick it, and for nothing else.
• Camera is used to read a QR code when you add a two-factor code, and only on that screen. The picture is read for the code and thrown away; nothing is photographed, saved or sent, and the app has no photo or video output at all. You are asked for it when you open the scanner rather than at launch, and refusing costs only that one way in: the same code can be read from a screenshot, pasted as a link, or typed by hand.
• Network: on the free Android version, for the advertising described above and for nothing else. Nothing in the app opens a connection of its own, and PP Vault Pro has no advertising. The extension requests access to a page only when you click its toolbar button on that page, and uses it to fill a login you asked it to fill; it reaches no network at all.

Autofill

If you turn autofill on for a vault, that vault's site names and usernames are made readable to your device's autofill system so it can offer them; passwords are released only after you enter your picture password. Nothing is sent anywhere. The feature is off by default and per vault.

Children

PP Vault stores what you put in it and sends nothing to anyone; there is no collection to disclose under any age. It is not directed at children.

Changes

This policy can only change in the repository, in public, with the change visible in the history. If a change ever adds collection of anything, the app it ships with will say so in the open before the change applies.

Contact

Questions and reports are welcome as issues on the repository.