Last updated 14 August 2026
Sahayak Vault ("the App") is a local-first password and credential manager. This policy explains what data the App handles, where it lives, and what — if anything — ever leaves your device.
The App has no account system, no sign-up, and no login of its own. The only way into the App is your device's own biometrics or passcode (Face ID, Touch ID, fingerprint, or device PIN/pattern). We do not operate a server that stores, sees, or has access to your vault data. Everything you save — website logins, bank account details, credit/debit card details, insurance policies, notes, and anything else — is stored only in an encrypted database file on your own device.
Your entire vault database is encrypted at rest using a 256-bit key that is generated on your device and stored in your device's own secure hardware-backed storage (iOS Keychain or Android Keystore), gated behind your device's biometric/passcode check. Passwords and card CVVs additionally get a second, independent layer of AES-256 encryption before being written to disk. We never see this key, and we have no way to decrypt your data — if you lose your device and its biometric/passcode access without a backup, your vault data cannot be recovered by us or anyone else.
On iOS, your vault's encryption key (not your vault data itself) can sync automatically across your own devices via Apple's iCloud Keychain, if you have iCloud Keychain enabled in your device settings — this is Apple's own end-to-end encrypted service; we have no access to it.
On Android, you may optionally sign in with a Google account to back up your encrypted vault file to a private, app-specific area of your own Google Drive ("appDataFolder") that only this App can access — not your general Drive storage. This is entirely optional and off by default. You can delete this backup at any time from your Google Account's own storage management.
Free use of the App is supported by advertising, served through Google AdMob. AdMob and its partners may collect device identifiers and usage data to serve and measure ads. On iOS, we ask for your tracking permission (App Tracking Transparency) before any personalized-ads identifier is used — if you decline, you still see ads, just less personalized ones.
The App offers an optional Premium subscription (ad removal and extra accent colors), purchased through Apple's App Store or Google's Play Store. All payment processing is handled entirely by Apple/ Google — we never see or store your payment card details.
We do not collect your name, email address, or any other personal identifier, because the App never asks for one, and we do not run analytics services that track how you use the App. We do use a crash-reporting service that automatically sends us a diagnostic report if the App crashes — the device model, OS version, App version, and the technical error details at the moment of the crash — purely to help us find and fix bugs. These reports never include your vault data or any of the sensitive information you store in the App.
The App is not directed at children under 13, and we do not knowingly collect data from children.
Uninstalling the App permanently deletes your entire local vault. If you enabled the optional Android Google Drive backup, deleting that backup is a separate step you can take from your Google Account.
If this policy changes, an updated version will ship with a future App update, with a new "last updated" date above.
Questions about this policy? Contact us at sahayaktracker@gmail.com.