HomeVault is an offline password and secrets manager. There is no HomeVault account, no HomeVault server, and no HomeVault database of users. We do not collect, receive, transmit, or store any of your personal data.
Everything you save stays encrypted on your device. If — and only if — you switch on Google Drive sync, an encrypted copy is stored in your own Google Drive, encrypted on your device before it leaves it. We never see it, and neither can Google.
HomeVault is published by the developer identified on the app's Google Play listing. All privacy questions can be sent to home.vault.help@gmail.com.
For the purposes of data-protection law, you are the controller of your vault contents: they are held on your device and, optionally, in your own Google Drive account. We have no access to them at any time.
None.
HomeVault does not send your data anywhere we control. We operate no servers that receive app data. We do not ask for your name, email address, phone number, or any account registration. We have no ability to read, recover, reset, or hand over your vault.
The sections below describe data that is created and stored on your device, or sent directly to a third-party service you have chosen (Google Drive, Google Play).
All of the following stays on your device unless you explicitly export it or enable sync.
The records you create — titles, usernames, passwords, card details, notes, keywords, photos, and file attachments — are stored in an encrypted database file in the app's private storage.
We cannot recover your master password or your data if you forget it. There is no reset link, no recovery email, and no backdoor — that is the point of the design.
If you attach a photo to a record, it is encrypted and stored in the vault exactly like every other field. The camera permission is used only at the moment you take a photo for a record. Photos chosen from your gallery go through the Android system photo picker, which grants access to the single item you pick. No photo, image, or attachment is uploaded anywhere except into your own encrypted vault (and, with sync enabled, your own Drive copy of it).
The app stores locally: your app preferences, the wrapped (encrypted) database key and its salt, an optional biometric-unlock key held in the Android Keystore, an optional edit PIN, and — if you use Drive sync — the Google account email address you selected and an OAuth access token for that account. These are on your device only.
A local audit trail records that certain events happened: vault created, opened, renamed, synced, backed up, restored, password or PIN changed, sync interval changed, Premium subscription started or ended. Each entry holds an event type and a timestamp, plus, where they apply: the vault name (and the previous name when a vault is renamed), a count, the Google account used for a Google Drive operation, and a brief failure reason when an operation fails. It never records field values, titles, keywords, app packages, or website addresses. It stays on your device and can be cleared by you.
If you turn on diagnostics in Settings to troubleshoot a problem, the app records technical event codes, counters, timings and true/false flags in memory for a limited session; it stops automatically after 10 minutes or when you leave the app. So that a problem can actually be diagnosed, entries can also include: the vault name, the Google account used for Drive sync, the app package or website domain involved when autofill is used, and failure details (an error type and message, or the HTTP status and error response returned by Google's servers).
By design the app never writes your vault content (titles, keywords, field values, notes, images), passwords or PINs, encryption keys, or Google access tokens into this log. Nothing is written to disk unless you tap Export, which creates a file you can then choose to share — for example by emailing it to us for support. Because an exported file can contain the items listed above, look it over before you send it. If you send us such a file, we use it only to diagnose your issue and delete it when the issue is closed.
The device's name (for example "Jo's Pixel", or the manufacturer and model) is recorded inside records so you can see which device last changed an entry; it is stored encrypted with the record.
To protect your secrets, HomeVault checks whether the device appears to be rooted or otherwise compromised, by reading system properties and by checking whether known root-manager apps are installed. It also checks that the app itself has not been modified or re-signed, and that no debugger is attached to it. These checks run entirely on-device and their results are not transmitted anywhere.
Drive sync is off by default and only runs if you enable it and sign in with a Google account you choose.
HomeVault inside your own Google Drive. It is not shared with us, or with anyone you do not share it with yourself.drive.file scope only. This is the most restrictive Drive permission available: the app can see and manage only the files it created itself, and has no visibility into the rest of your Drive.Google's handling of files in your Drive is governed by the Google Privacy Policy.
HomeVault's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google APIs is used solely to provide the vault-sync feature you enabled; it is not sold, not transferred to third parties except as required to provide that feature, not used for advertising, and not read by humans.
You can disconnect sync in the app's settings at any time, revoke HomeVault's access to your Google account at myaccount.google.com/permissions, and delete the vault file from your Drive.
You can export your vault to a single encrypted file and store it wherever you like. The file is encrypted with your master password — anyone who obtains the file without the password cannot read it. Once exported, the file is under your control and this policy no longer governs where you keep it. Restoring requires the master password that protected it.
If you enable HomeVault as your Android autofill service, the app receives details of the form being filled in another app or browser in order to offer matching logins. This matching happens entirely on your device, only while the vault is unlocked, and nothing is filled without your explicit selection. The identity of the apps and websites you visit is not logged, stored, or transmitted by default. The one exception is the opt-in diagnostic log described in section 03: while diagnostics is switched on, it can record the app package or website domain of an autofill request, in memory only unless you export it. If you choose to save a new login from an autofill prompt, the site address and username are stored in your encrypted vault like any other record.
Backups, restores, and syncs run as an Android foreground service so they finish even if you leave the app, which requires a visible notification. Those notifications carry only status words such as "in progress", "done", or "failed" — never vault names, record contents, or account details.
HomeVault is free to use with no time limit: a vault of up to 15 records with every security feature, including autofill and biometric unlock. There is no trial period. An optional yearly subscription (Premium) unlocks unlimited records, local backup and restore, and Google Drive sync. The subscription is sold through Google Play Billing. All payment processing is handled by Google Play. We never see or store your payment card, billing address, or Google account details. The app checks your purchase status through Google Play's billing service and stores the resulting entitlement locally on the device. Your purchase history is governed by Google's own terms and privacy policy.
We do not sell, rent, trade, or share your data — because we do not have it.
No advertising networks, analytics providers, crash reporting services, or third-party trackers are integrated into HomeVault. The only external services the app can contact are Google Drive (only if you enable sync, and only your own account) and Google Play Billing (only for purchases). The app makes no other network connections.
To delete everything: delete the vault in the app or uninstall HomeVault, delete the HomeVault folder from your Google Drive, revoke the app's Google account permission, and delete any backup files you exported.
No system is perfectly secure, and the security of your vault depends on the strength of your master password and the integrity of your device.
HomeVault is not directed at children and is not intended for use by anyone under 13 (or the equivalent minimum age in your country). We do not knowingly collect data from children — we do not knowingly collect data from anyone.
Data-protection laws such as the GDPR and the CCPA give you rights to access, correct, export, and delete your personal data. Because your data never reaches us, you exercise these rights directly: your vault is on your device, readable and editable in the app, exportable as a backup file, and deletable at any time. We sell no personal information and have none to disclose. If you believe we hold information about you, write to home.vault.help@gmail.com and we will respond.
We transfer no data internationally, since we receive none. If you enable Drive sync, your encrypted file is stored on Google's infrastructure under Google's terms.
We may update this policy — for example when a new feature changes what the app does. The updated version will be posted at this address with a new "Updated" date, and material changes will be noted in the app's release notes. Continuing to use HomeVault after an update means you accept the revised policy.
Questions, requests, or concerns: home.vault.help@gmail.com
Provided to make the Data safety declaration straightforward. Verify against the current form before submitting.
| Question | Answer |
|---|---|
| Does your app collect or share any of the required user data types? | No |
| Is all user data encrypted in transit? | Yes — HTTPS, plus end-to-end encryption of the bundle before upload |
| Do you provide a way for users to request that their data be deleted? | Yes — in-app deletion and uninstall; no server-side data exists |
| Data types collected | None |
| Data types shared | None |
| Data collected for advertising or analytics | None |
| Third-party SDKs receiving user data | None — Google Play Billing and Google Sign-In are used only for purchases and for access to the user's own Drive |
"Collect" in the Play Console sense means data transmitted off the device to the developer or a third party. HomeVault transmits vault data only to the user's own Google Drive, at the user's instruction, end-to-end encrypted — which Play treats as user-initiated transfer to a service of the user's choosing, not collection by the developer.