Privacy Policy

Lockboxy is offline-first and has no user account and no backend server of our own. Everything you put in the vault — photos, videos, documents, note text, wallet entries (card numbers, passwords, Wi-Fi, 2FA codes, crypto seed phrases), audio recordings, private contacts, and browser bookmarks — is:

• Encrypted on your device with AES-256-GCM before it is written to storage, including thumbnails and sensitive metadata such as file names and titles.
• Protected by a key derived from your passcode (Argon2id) that is never stored in raw form and never leaves your device.
• Never transmitted to us. We operate no server that could receive it, and we cannot read it.

Because the encryption key is derived from your passcode, forgetting your passcode means the data cannot be recovered — by you or by us — unless you generated a Recovery Key in advance (a Premium feature). There is no backdoor. The app warns you about this when you first set your passcode.

Lockboxy uses Firebase Analytics (Google) to understand which features and screens people use — for example, app opens, screens viewed, and generic actions like “opened the vault” or “changed a setting”. This data:

• Is anonymous — a random per-install identifier, never your name, email, or any vault content.
• Never includes the contents, file names, note text, contacts, or any item you store.
• Is never used for advertising, never sold, and never used to track you across other apps or websites.

Google's privacy policy governs how it processes this data: policies.google.com/privacy.

Premium is an optional subscription (Monthly, Yearly with a 3-day free trial, or a one-time Lifetime purchase). Prices in Vietnam are Monthly ₫49,000, Yearly ₫299,000, and Lifetime ₫599,000; prices vary by country/region and the exact price is always shown in the app before you buy. Payments are handled entirely by the App Store or Google Play — we never see your card or payment details. We use RevenueCat to manage subscription status; it stores your purchase state (which plan, active or expired) against a random app-user identifier, not your name or email. This is used only to unlock the features you paid for and to restore purchases. See revenuecat.com/privacy and apple.com/legal/privacy.

The free plan shows ads via Google AdMob: an interstitial ad when you lock the vault, and an optional rewarded ad to unlock extra free storage slots. Premium removes ads entirely. AdMob may use device advertising identifiers to serve and measure these ads, governed by Google's own policies (see google.com/policies/technologies/ads) — your vault content is never included or used for ad targeting.

The app only requests a permission when you use the feature that needs it, and explains why at that moment:

• Photo Library — only if you import from the in-app library picker, to browse and (optionally) remove the originals after hiding them, and to put them back when you “unhide”. Sharing photos or videos in via the Share Sheet from Photos or any other app needs no Photos permission at all.
• Camera — only if you turn on Intruder Selfie (Premium): it photographs whoever enters a wrong passcode. Those photos are stored encrypted inside the vault and are never uploaded.
• Microphone — only while you record a voice memo into the vault; recordings are stored encrypted and never uploaded.
• Files — to import documents you pick yourself, via the system file picker or the Share Sheet.

You can decline or later revoke any of these in your device Settings; the related feature simply won't be available.

The in-app Private Browser fetches the web pages you visit directly from your device to those websites; those sites are governed by their own privacy policies. Your browsing history and cookies are kept inside the encrypted vault, not shared with us, and files you download are encrypted into the vault immediately.

Lockboxy has no cloud account of ours. Tapping "Back up now" exports an encrypted backup file and opens your device's own share sheet — you choose where it's saved (your iCloud Drive, Google Drive, Files, or elsewhere). It stays encrypted throughout and we never receive a copy. This is a manual, one-tap export, not an automatic background sync — the app can optionally remind you if it's been a while since your last one.

Lockboxy is not directed to children and we do not knowingly collect data from them.

We may update this policy; the effective date above will change accordingly.