Privacy policy

Last updated 12 November 2026. This policy covers the Personal Vault apps for Windows and Android, made by SriNani.

The short version

Your notes, passwords, cards and other items are encrypted on your own device. Nobody else can read them, including us.
We have no servers that hold your vault, no accounts, no ads, no analytics and no tracking.
If you connect Google Drive, the app keeps encrypted copies in your own Drive, and can only see the files it made itself.

Your vault

Everything you keep in Personal Vault is encrypted with AES-256-GCM using a key made from your master password. The master password never leaves your device and is never sent to us or to anyone else. Without it, your vault can't be opened, so we can't recover it for you.

Google Drive

Connecting Google Drive is optional. If you connect it, Personal Vault asks Google for one permission: to see, create and change only the files Personal Vault itself creates in your Drive (Google's drive.file permission). It can't see any of your other files.

The app uses that permission only to store and read its own encrypted backup and sync files in your Drive, so your PC and phone stay in step. Those files are encrypted before they leave your device, so Google can't read them either. Your Google data is never sent to us, sold, shared, used for advertising, or used to train AI models.

You can disconnect Drive in the app's Settings at any time, and remove the app's access in your Google Account at myaccount.google.com/permissions. The files it made stay in your Drive until you delete them.

Personal Vault's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Optional features that go online

Password leak check: asks Have I Been Pwned whether a password has appeared in a data breach. Only the first 5 characters of the password's SHA-1 hash are sent, never the password itself.
Breach and 2-factor lists: the app downloads public lists of known data breaches and of websites that support 2-factor codes. Nothing about you or your vault is sent.
Website icons (only if you turn them on): each website in your logins is asked for its own icon, so no icon service learns which sites you use. The icons are kept encrypted in your vault.
Links you open: buttons such as "Add to Google Calendar" or a website's address open in your browser only when you tap them.

Buying a licence (paid edition)

The paid edition shows a short device code (for example 7F3K-92XQ). It is made from a one-way scramble of your device's ID, so the ID itself can't be worked out from it. When you buy, you send us that code with your name, your contact (WhatsApp or email) and your payment reference. We keep those details only to make your licence key, to help you with it, and to withdraw a key that was shared or refunded. Payments go through your own UPI or payment app; we never see your card or bank details.

Licensed copies check for updates and for withdrawn keys through our update server, sending the licence key so the server can tell it's valid. The server doesn't store your key or anything from your vault. Like any website, it is hosted by Cloudflare, which may keep short-lived technical logs such as your internet address.

Children

Personal Vault isn't aimed at children under 13 and doesn't knowingly collect anything from them.

Changes and contact

If this policy changes, the new version will be posted on this page with a new date. Questions or requests: kogantiaditya1990@gmail.com.