Privacy policy

Last updated 12 November 2026. This policy covers the Personal Vault apps for Windows and Android, made by SriNani.

The short version

Your notes, passwords, cards and other items are encrypted on your own device. Nobody else can read them, including us.
We have no servers that hold your vault, no accounts, no ads, no analytics and no tracking.
If you connect Google Drive, the app keeps encrypted copies in your own Drive, and can only see the files it made itself.

Your vault

Everything you keep in Personal Vault is encrypted with AES-256-GCM using a key made from your master password. The master password never leaves your device and is never sent to us or to anyone else. Without it, your vault can't be opened, so we can't recover it for you.

Google Drive

Connecting Google Drive is optional. If you connect it, Personal Vault asks Google for one permission: to see, create and change only the files Personal Vault itself creates in your Drive (Google's drive.file permission). It can't see any of your other files.

The app uses that permission only to store and read its own encrypted backup and sync files in your Drive, so your PC and phone stay in step. Those files are encrypted before they leave your device, so Google can't read them either. Your Google data is never sent to us, sold, shared, used for advertising, or used to train AI models.

You can disconnect Drive in the app's Settings at any time, and remove the app's access in your Google Account at myaccount.google.com/permissions. The files it made stay in your Drive until you delete them.

Personal Vault's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Optional features that go online

Password leak check: asks Have I Been Pwned whether a password has appeared in a data breach. Only the first 5 characters of the password's SHA-1 hash are sent, never the password itself.
Breach and 2-factor lists: the app downloads public lists of known data breaches and of websites that support 2-factor codes. Nothing about you or your vault is sent.
Website icons (only if you turn them on): each website in your logins is asked for its own icon, so no icon service learns which sites you use. The icons are kept encrypted in your vault.
Links you open: buttons such as "Add to Google Calendar" or a website's address open in your browser only when you tap them.

Buying a licence (paid edition)

The paid edition shows a short device code (for example 7F3K-92XQ). It is made from a one-way scramble of your device's ID, so the ID itself can't be worked out from it. We keep the details below only to make your licence key, to help you with it later (for example with a new phone), and to withdraw a key that was shared or refunded. They're used for nothing else, and never shared or sold. To have them removed, email us.

On the payment page: payments are handled by Razorpay. Your card, UPI or bank details go to Razorpay, under Razorpay's own privacy policy; we never see them. The page asks for your name, email, phone number and device codes. Razorpay passes those, with the amount, how you paid and the payment's reference, to our small order server (run on Cloudflare), so we can make your keys.
Paying by UPI directly: you send us your device codes with your name, your contact (WhatsApp or email) and your payment reference. The payment goes through your own UPI app.

Licensed copies check for updates and for withdrawn keys through our update server, sending the licence key so the server can tell it's valid. The server doesn't store your key or anything from your vault. Like any website, it is hosted by Cloudflare, which may keep short-lived technical logs such as your internet address.

Children

Personal Vault isn't aimed at children under 13 and doesn't knowingly collect anything from them.

Changes and contact

If this policy changes, the new version will be posted on this page with a new date. Questions or requests: kogantiaditya1990@gmail.com.