Privacy policy

Effective 30 October 2026 · Applies to the Vaultmark app (shown as "Vault" on your phone) and this website

1. Who we are

Vaultmark is made by an independent developer ("we", "us"). If you have any question about this policy, write to sainivarnit@gmail.com.

2. What we collect

Nothing. Vaultmark has no user accounts and runs no servers. The app contains no analytics, advertising, attribution, crash-reporting or remote-configuration software. We don't know who uses the app, how often, or what they keep in it.

The only time any information reaches us is when you choose to contact us, for example with Send feedback in Settings. That opens your own email app. The draft contains only the app version and your phone's system version, which you can delete before sending. We receive whatever you decide to send, use it only to reply to you and to improve the app, and delete it when it's no longer needed. We never share it.

3. What stays on your phone

Your vault is stored inside the app's private storage on your phone, encrypted. That includes the content of every photo, video and file, and also their names, types, sizes, dates, thumbnails and folders. The keys that unlock it are protected by your phone's secure hardware and never leave the phone. Vaultmark also keeps, on your phone only, a count of failed unlock attempts (to slow down guessing) and your theme choice.

Vaultmark excludes its storage from your phone's own system backups, so your vault is not copied into a device backup by Android.

When you open a photo, a decrypted copy exists briefly in a protected temporary folder and is deleted when you close it or the vault locks. Videos are decrypted as they play, in memory, without writing a file.

4. Backup to your own cloud (optional)

If you turn on backup, Vaultmark uploads your vault to a hidden, app-only folder in your own Google Drive (the Drive "app data" folder). Everything is encrypted on your phone before upload, with a key that comes from your 12-word recovery phrase. Without that phrase, the backup can't be read by Google, by anyone who gets into your Google account, or by us.

• Vaultmark asks Google only for access to its own app folder (drive.appdata). It can't see your other Drive files, and it doesn't request your name, email or profile.
• The connection is made directly between your phone and Google. Nothing passes through us.
• Google, as the storage provider, can see things any cloud service sees: that the app's folder exists in your account, how many encrypted objects it holds, their approximate sizes and when they were uploaded. It can't see what they contain.
• Your use of Google Drive is governed by Google's privacy policy.

When Vaultmark becomes available on iPhone, backup there will work the same way, in your own iCloud private database.

5. Purchases

Vaultmark Pro is sold through Google Play. Google handles the payment and your payment details; we never see them. The app only asks Google Play which purchases your account owns, on your phone, to unlock Pro features. Google Play's billing software includes its own usage logging; Vaultmark switches off the part that uploads those logs, so they stay on your phone. Your purchase is governed by Google's privacy policy and the Google Play terms. Like every Play developer, we receive Google's standard order records (such as order number, date, product, price and country) in the Google Play Console. We use them only for accounting, refunds and tax, and never link them to anything in the app.

6. Permissions the app uses

Vaultmark doesn't ask for access to your photo library or files. You choose what to bring in using your phone's own picker, and items you take out go through your phone's own save screen.

7. Things that leave Vaultmark's protection

• Items you take out. A copy saved with Take out of vault is no longer encrypted. Other apps, backups and sync services may read it, and Vaultmark can't delete it.
• Originals you import. Importing makes an encrypted copy. The original stays in your gallery until you delete it, and your phone may keep it in "Recently deleted" for about 30 days.
• The recovery sheet. If you save your recovery phrase as a PDF, that file is outside the vault. Keep it somewhere safe.

8. Keeping and deleting your data

Because we hold none of your data, there is nothing for us to keep, hand over or delete. You are in full control:

• Settings › Danger zone › Delete this vault deletes the open vault from your phone and, if it was backed up, from your Google Drive.
• Settings › Backup › Delete backup from Google Drive removes only the cloud copy.
• Uninstalling the app deletes everything on the phone. A backup stays in your Google Drive until you delete it from the app, or remove the app's data in your Google Drive settings.

If you lose both your pattern and your recovery phrase, nobody can open your vault, including us. There is no back door and no key escrow.

9. Your rights

Privacy laws such as the GDPR and India's Digital Personal Data Protection Act give you rights to access, correct and delete personal data held about you. We don't hold any personal data about you through the app, so there is nothing to provide. If you have emailed us, you can ask us to delete that correspondence at any time.

10. Children

Vaultmark is not directed at children under 13 and collects no information from anyone, of any age.

11. This website

This website uses no cookies, no analytics, no scripts and no third-party fonts or embeds. The company hosting it may keep standard server logs (such as IP address and pages requested) for security and operations, as with any website; we don't use them to identify or track visitors.

12. Changes to this policy

If this policy changes, we'll update it here and change the date at the top. If a change ever meant that any data would leave your phone in a new way, the app would ask you first.

13. Contact

Questions or concerns: sainivarnit@gmail.com.