Privacy Policy — Coldvault

Last updated: 1 September 2026

Coldvault is an offline password manager for Android.

Coldvault collects no data about you. Not your passwords, not your email, not your device ID, not analytics, not crash reports, not your usage.

We do not run a server. There is no account to create, nothing to log in to, and no copy of your vault anywhere but your own phone.

About the internet permission. Coldvault requests INTERNET and ACCESS_NETWORK_STATE for exactly one reason: Google Play's billing library, which the app uses to sell its one-time upgrade, requires them. The vault itself never uses the network. It has no code that opens a connection, sends a request, or contacts any server of ours — because we have no server for it to contact. Your passwords are never transmitted anywhere, by any code path, in any version.

We would rather the permission were not there at all. It is listed here plainly instead of being buried, because a password manager that is vague about its network access does not deserve to be trusted.

What Coldvault stores, and where

Everything Coldvault saves stays in the app's private storage on your own device:

Your entries — logins, passwords, notes and two-factor secrets — in a single encrypted database file, protected with AES-256 encryption.
The encryption key itself, stored only in wrapped (encrypted) form. Unwrapping it requires your master passphrase, or your fingerprint if you turned that on.
Your app settings, such as the auto-lock delay.

Your master passphrase is never stored anywhere, on the device or elsewhere. It is used to derive a key and then discarded from memory. This means nobody can recover it for you — not us, not Google, not anyone. If you forget it, your data is permanently unreadable. That is the direct cost of nobody else holding a key to your vault.

We never receive any of this. There is no server to receive it.

Permissions, and why each exists

Camera: Used only to scan QR codes: two-factor setup codes from websites, and credentials shared to you from another copy of Coldvault. The camera is active only while a scanner screen is open. Images are processed on the device, in memory, and are never saved, uploaded or shared.
Biometric / fingerprint: Used only to unlock your vault, if you choose to enable it. Your fingerprint never leaves the secure hardware on your phone. Coldvault never sees your fingerprint data; Android only tells the app whether the check succeeded.

Internet and network state: Used only by Google Play's billing library, to check whether you have bought the upgrade and to complete a purchase. No vault data is involved in either.

Coldvault requests no other permissions. In particular it has no location, contacts, storage-wide, microphone, or phone permissions.

Features that involve other people or files

Exporting a backup. You can export your vault to a file. Android asks you where to save it, and the file goes only where you choose. Once it leaves the app it is your responsibility — if you save it to a cloud folder, that cloud provider's terms apply to it, not ours. We never see it.

Sharing a credential. You can share an entry as a QR code for another person to scan with their own copy of Coldvault. The data travels from one screen to one camera. It does not pass through any server, ours or anyone else's.

Third parties

Coldvault contains no advertising, no analytics, and no trackers.

Google Play Billing is included so the app can sell its one-time upgrade. When you buy, or when the app checks whether you have already bought, it talks to Google Play — never to us, and never with any of your vault contents. Google handles the payment and tells the app only whether the upgrade is owned. What Google collects in the course of that is covered by Google's Privacy Policy.

The app is built using open-source libraries (including SQLCipher for database encryption, Argon2 for key derivation, and ZXing for QR scanning). These run entirely on your device and none of them transmit data.

If you obtained Coldvault from Google Play, Google collects its own data about app installations and purchases under Google's Privacy Policy. That is between you and Google; we receive no personal information from it.

Children

Coldvault is not directed at children and collects no information from anyone, including children.

Your rights

Data-protection laws give you rights to access, correct, export and delete your personal data. In Coldvault's case these are already fully in your hands and require no request to us:

Access and export — Settings → export your vault to a file.
Correct — edit any entry directly.
Delete — Clear all entries empties the vault and keeps it; Delete vault erases everything and returns the app to its first-run state. Uninstalling the app also removes all of its data.

We hold no copy of your data, so there is nothing for us to delete on our side and no request we could act on.

Changes to this policy

If this policy changes, the updated version will be posted at this address with a new date at the top. If a future version of Coldvault ever collects or transmits anything about you or your vault, that change will be stated here plainly and prominently before it ships — it would be a fundamental change to what this app is.

Contact

Questions about this policy: bobthebuilder6145@gmail.com