Privacy Policy for btw vault
btw vault is an offline-first, client-side encrypted password manager. The application operates under a strict zero-knowledge architecture: your private credentials, tokens, and notes are never transmitted to any external server owned or operated by the developer.
01. Zero Data Collection & Zero Telemetry
We do not collect, transmit, store, or monetize any personal information or telemetry. There are no advertising SDKs, behavioral tracking cookies, or remote analytics engines embedded within the application.
- No Account Registration: You do not need to register an account or provide an email address to use btw vault.
- No Telemetry SDKs: We do not monitor which features you access, how often you unlock your vault, or which categories you configure.
- No Device Identifiers: We do not log advertising identifiers (GAID), IMEI, MAC addresses, IP addresses, or hardware fingerprints.
02. Local Cryptographic Storage
All credentials, login items, credit cards, notes, and custom categories are encrypted locally on your device using SQLCipher (AES-256 in CBC mode) with 4096-byte page-level encryption and cryptographic HMAC verification.
Your Master Password is never written to persistent disk storage. It is processed in volatile memory using the memory-hard Argon2id key derivation function (4MB RAM memory cost, 2 iterations, 256-bit cryptographically secure salt).
03. Biometric Authentication
When you enable Biometric Unlock (Fingerprint / Face Unlock), verification is delegated strictly to your mobile device's native hardware security module (Android Keystore / iOS Secure Enclave). The application never accesses, processes, or transmits biometric sensor data or biometric templates.
04. Optional Google Drive Cloud Backup
If you voluntarily link your personal Google Drive for automated or on-demand backups:
- All vault data is client-side encrypted before transmission using your derived master key. Google only receives an opaque, ciphertext snapshot container.
- The application requests only the isolated
drive.appdatapermission scope, restricting it entirely to the hidden application folder. It cannot inspect or access your personal files, photos, or documents stored in Google Drive. - The developer operates no intermediary relay server; all network traffic travels directly between your device and Google's official endpoints over HTTPS/TLS 1.3.
05. Complete User Data Deletion (Wipe Vault)
You have absolute sovereignty over your cryptographic vault. You can tap "Wipe Vault" in Settings at any time to execute an irreversible cryptographic destruction of the on-device SQLCipher database, write-ahead log buffers, security configurations, and derived keys.
06. Children's Privacy
btw vault does not collect personal information from any user, including children under 13.
07. Developer Contact & Inquiries
For questions regarding this policy or the cryptographic design of btw vault: