Privacy Policy

Last updated 15 October 2026.

PP Vault is a vault that lives on your device. This policy is short because the honest answer to most questions a privacy policy exists to answer is "nothing" and "nobody".

What we collect

Nothing.

PP Vault has no accounts, no server, no analytics and no crash reporting. The app does not know who you are, and there is no channel through which anything you store, type or do could reach us. We cannot see your data, lose your data, sell your data or be compelled to hand it over, because we never have it. That is unchanged and it is the point.

The one exception is buying PP Vault Pro for the browser extension on this website. It asks for no email, name or account, only your PP Vault's id; what it keeps is under Buying Pro for the browser extension, and none of it is anything from a vault.

Advertising, on the free phone versions

The free Android and iPhone versions show a banner from Google AdMob on two screens: the grid of folders a vault opens on, and the list inside a folder. It appears nowhere else, and in particular never on a screen where a password is being entered or where anything out of a vault is shown. PP Vault Pro has no advertising, and on Android it also leaves the SDK's permissions out of what the app uses.

The banner refreshes while one of those screens is open, which means an ad request roughly once a minute rather than one per visit. It stops when the screen does: leaving the folder screens, or leaving the app, stops the requests.

Google receives what it receives for any ad request: an advertising identifier, the device model and language, and an approximate location derived from the IP address the request came from. It does not receive anything from a vault, because nothing in the app hands it anything: the ad view is given a screen position and nothing else. Google's own policy governs what it then does, and it is at policies.google.com/technologies/ads. You can reset or delete the advertising identifier in Android's own settings, under Privacy, and the ad still loads without it. On Android 13 and newer the SDK may also use Google's Privacy Sandbox, which is what the AdServices entries in the app's permission list are: interest topics and install attribution, held by the operating system rather than by this app, and read by Google rather than sent by us.

On an iPhone that identifier is read only if you allowed it when the app asked. iOS asks its own question, after the one below and separately from it, and refusing means the banner asks for an ad that was not chosen for you: it still loads, and every other part of the app works exactly as it did. You can change that answer at any time in the iPhone's own Settings, under Privacy and Security, Tracking.

Being asked first. Before the first ad request, the app asks. It uses Google's own consent platform, which decides from where the device is whether a form is owed and what it says: in the EEA, the UK and Switzerland a form appears and nothing is requested until it has been answered. A refusal is a complete answer and costs you an ad and nothing else. The choice can be changed afterwards from Settings, under Ad privacy choices, on every device where there was a form to begin with.

Nothing about that question reaches a vault either. The app asks it on the folder screen and not at launch, because a dialog from Google over the picture password is the same intrusion the banner itself is kept away from, and a phone whose owner never unlocks anything should never have been asked at all.

The browser extension has no advertising and no ad SDK, and nothing in it reaches an ad network at all.

Buying Pro. PP Vault Pro is one purchase, and what matters on this page is that it turns the advertising off. It is the same purchase on both phones: bought once, owned for good, and restored on any device signed in to the same account. It unlocks nothing inside a vault, because nothing inside a vault is behind it.

On Android the purchase is made through Google Play, and on an iPhone through the App Store. The app hands the store a product name and gets back a price and a receipt; it sends no account, no device identifier and nothing from a vault, because it holds nothing of the sort to send. The store already knows what that account has bought, and buying Pro does not create an account in this app: there still is not one.

Buying Pro for the browser extension

PP Vault Pro for the Chrome extension is bought on this website, at ppvault.app/pro, in USDC or USDT. It is the one place PP Vault keeps anything about anybody, and this is all of it:

• Your PP Vault's id, the licence code made for it, the amount you were asked to pay and when, the payment it matched (the network and the transaction ID), and how many times the licence has been moved to another PP Vault, and the promo code used, if one was. These are kept so that a lost licence can be found again from the id, and moved with the receipt code. Nothing else is asked for: no email, no name, no card, no account and no password.
• So one visitor cannot open thousands of orders, a count per IP address for the hour. It is kept as a one-way hash, never the address itself, and deleted after the hour.
• Every USDC and USDT payment to the shop's address, as the blockchain already records it in public: network, transaction ID, amount and time.

The PP Vault id is drawn from your vault's recovery words by a one-way hash: it says nothing about the words, and nothing in your vault can be read or reached from it. It is the same in every backup of that vault, so it can tell the shop that a licence and a vault belong together, and nothing more.

Cloudflare runs the page and its database, under its own policy. No email is sent, so nobody else is involved.

A blockchain is public. Anybody can see that a payment was made to the shop's address, from which wallet, for how much and when. That wallet is linked to a PP Vault id only in the shop's database, and the id to nobody. So this is private rather than anonymous: no name and no card, but a payment that can be seen.

The licence code has your PP Vault's id inside it, and the extension shows the id in Settings. The extension checks the code by itself and still cannot reach the internet at all, before or after you buy.

Write to us with your receipt code and we will delete your order from the database. The licence keeps working in the extension, but it can no longer be found again if lost, or moved. The payment stays on the blockchain, where nobody can delete it.

What stays on your device

Everything you put in the vault: your photograph, your files, notes, logins and authenticator codes, your picture password, and the app's own counters. All content is encrypted with AES-256-GCM before it is written; on Android the sealing key lives in the Android Keystore (StrongBox where the phone has it) and on iOS behind the Secure Enclave, in both cases marked so it cannot leave the device it was made on. In the browser extension the key is a non-extractable browser key.

Backups

Backups are files you create, encrypted with AES-256-GCM before they leave the app. They are written where you choose to put them, and they open with your seventeen-word recovery phrase, or on a phone with a passkey and the second half you chose for it. If you copy a backup to a cloud drive, that drive's operator holds ciphertext we cannot read and neither can they; their handling of the file is governed by their policy, not this one.

On Android you can choose Google Drive for backups. This is the one thing in PP Vault that uses an account, and it is yours, not ours: Google's own screen asks which Google account and whether PP Vault may add files to its Drive. PP Vault then uploads the encrypted backup file, and nothing else, straight from your phone into a PP Vault folder in that Drive. It can see only the files it made there, never the rest of your Drive. We never receive the file or your account details, and PP Vault keeps no password or token: Google Play services hands over short-lived access each time. You can take the access back at any time in your Google account's settings.

On iPhone, Save to iCloud Drive puts the encrypted backup file in a PP Vault folder in your iCloud Drive, through Apple's iCloud, with no account of ours involved.

Permissions

Named the way Google Play's listing names them, so this page can be read beside it.

• Camera is used to read a QR code when you add a two-factor code, and only on that screen. The picture is read for the code and thrown away; nothing is photographed, saved or sent, and the app has no photo or video output at all. You are asked for it when you open the scanner rather than at launch, and refusing costs only that one way in: the same code can be read from a screenshot, pasted as a link, or typed by hand.
• Location and Wi-Fi connections are one feature and not two, and the feature is optional. A vault can be set to open only on a network you name. Android will not tell an app which Wi-Fi network it is on unless that app can also ask for location, so the app has to hold the location permission in order to read a network's name. It reads the name and nothing else: no coordinate is read, stored or sent, and there is nowhere for one to go. The prompt appears only if you open Settings, Wi-Fi Hide and set a rule; a phone that never sets one is never asked. iPhone charges the same price for the same fact.
• Full network access and View network connections: on the free version, for the advertising described above and for nothing else. Nothing in the app opens a connection of its own. It is worth being plain that this is a promise where it used to be a proof: before the banner, the app could not reach the network at all and anybody could check that by reading the permission list. PP Vault Pro has no advertising. The browser extension asks for access to a page only when you click its toolbar button on that page, uses it to fill a login you asked it to fill, and reaches no network at all. Chrome also lists access to www.ppvault.app, our own domain: that is only so the extension's backup passkey can belong to the same domain as the phone apps', and the extension never opens or reads that site.
• Advertising ID is what an ad is chosen by, and it is described above. You can reset or delete it in Android's own settings, under Privacy, and the banner still loads without it. PP Vault Pro never asks for it.
• Google Play billing is how the one purchase that removes the advertising is made. The app hands the store a product name and gets back a price and a receipt.
• Prevent phone from sleeping is for scheduled backups, and only if you turn one on. When a backup is due, Android's own job scheduler holds the phone awake for the few seconds it takes to write the file and then lets go. Nothing of ours runs in the background otherwise, and the app has no server to wake up for.
• Photos and files are not in that list, and their absence is the point. Choosing your vault picture, adding a file or writing a backup opens the system's own picker, and the app is handed the one thing you chose. It holds no storage or photo permission at all, so it cannot see your library or your files, and you can confirm that from the same listing these lines describe.

Autofill

If you turn autofill on for a vault, that vault's site names and usernames are made readable to your device's autofill system so it can offer them; passwords are released only after you enter your picture password. Nothing is sent anywhere. The feature is off by default and per vault.

It fills login forms on web pages and apps you have told it about. The first time you use it in an app, it asks which of your logins that app is, and records the app against that login so it does not ask again. What is recorded is the app's identity as the phone reports it, kept in your vault with the login, and it goes nowhere else.

Children

PP Vault stores what you put in it and sends nothing to us; beyond the order a purchase on this website keeps, which names no person, there is no collection to disclose under any age. It is not directed at children.

Changes

Any change to this policy is published here, and this page carries the date it last changed. If a change ever adds collection of anything, the version of the app it ships with will say so before the change applies.

Contact

Questions and reports are welcome at