Google Play Data Safety Declaration
PLAY CONSOLE COMPLIANTTARGET APPLICATION: btw vault • PACKAGE: com.btwvault.app • SPECIFICATION VERSION: 1.3.4
This document details the official answers and cryptographic disclosures submitted to the Google Play Console under the Data Safety section for com.btwvault.app.
Data Collection & Sharing Summary
| Play Console Question | Official Response | Technical Architecture Details |
|---|---|---|
| Does your app collect or share user data? | No | Credentials, payment cards, and private notes are stored solely in an on-device encrypted SQLCipher container. The developer operates no server to receive or collect data. |
| Is data encrypted in transit? | Yes | When Google Drive sync is configured, snapshots are encrypted on the client device using AES-256 and transmitted directly via TLS 1.3 to Google Drive endpoints. |
| Do you provide a way for users to request data deletion? | Yes | Users can permanently destroy local vault databases, keys, and cached credentials via "Wipe Vault" in the application settings. |
Data Categories Breakdown
| Category | Collected? | Shared? | Declaration Context |
|---|---|---|---|
| Location | No | No | No location APIs, GPS, or cell triangulation services are linked or invoked. |
| Personal Information (Name, Email, Phone) | No | No | No account registration required. Google OAuth is used strictly for user-authenticated direct Drive sync. |
| Financial Information (Card Numbers, Bank Info) | No | No | User-stored cards remain locked within the SQLCipher AES-256 database on the device. |
| Health & Fitness | No | No | Not applicable to utility credential management. |
| Messages, Photos, Audio | No | No | No access to device photo library, microphone, or SMS. |
| App Activity & Telemetry | No | No | Zero analytics engines, event trackers, or crash log aggregation services. |
| Device or Other Identifiers | No | No | No advertising ID (GAID), hardware serial numbers, or IMEI tracking. |
Hardware & Cryptographic Security Safeguards
Client-Side Encryption at Rest
Local storage uses native SQLCipher with 4096-byte page encryption (AES-256-CBC) and per-page SHA-512 HMAC verification.
Memory-Hard Key Derivation
Argon2id derives cryptographic keys with 4MB memory cost, 2 iterations, and 256-bit unique salt to prevent GPU attacks.
Anti-Capture Screen Shield
Hardware secure surface flag (FLAG_SECURE) blocks screenshots and screen recording across all vault views.