Privacy Policy

Lockboxy is offline-first and has no user account, and no server of ours ever receives vault content — our only backend receives feedback you choose to send (see “Feedback you send us”). Everything you put in the vault — photos, videos, documents, note text, wallet entries (card numbers, passwords, Wi-Fi, 2FA codes, crypto seed phrases), audio recordings, private contacts, and browser bookmarks — is:

• Encrypted on your device with AES-256-GCM before it is written to storage, including thumbnails and sensitive metadata such as file names and titles.
• Protected by a key derived from your passcode (Argon2id) that is never stored in raw form and never leaves your device.
• Never transmitted to us or to any server of ours, and we cannot read it.

Because the encryption key is derived from your passcode, forgetting your passcode means the data cannot be recovered — by you or by us — unless you generated a Recovery Key in advance (a Premium feature). There is no backdoor. The app warns you about this when you first set your passcode.

Lockboxy uses Firebase Analytics (Google) to understand which features and screens people use — for example, app opens, screens viewed, and generic actions like “finished the intro tour”, “opened the Premium screen” or “changed a setting”. This data:

• Is anonymous — a random per-install identifier, never your name, email, or any vault content.
• May include which Premium plan you viewed or bought and whether the purchase completed — never your payment details.
• Never includes the contents, file names, note text, contacts, or any item you store.
• Is never used for advertising, never sold, and never used to track you across other apps or websites.

Google's privacy policy governs how it processes this data: policies.google.com/privacy.

From version 1.2.18, Lockboxy also uses Firebase Crashlytics (Google), acting on our behalf as a service provider, so that crashes can be found and fixed. When the app crashes, it sends a technical report containing:

• Where in the app's code the crash happened (a crash stack trace).
• Your device model, iOS version and Lockboxy version.
• A random installation identifier created by Crashlytics — not your name, email, Apple ID or any account.

Only native crash reports are sent: no app logs, custom data or user identifier. If a crash comes with an error message, paths, web addresses, email addresses, quoted text and file names are removed from it before it is recorded. Crash reports never include vault content, file names, note text, contacts or anything you type.

Crash reporting is always on in the app, with no setting to turn it off. It is not linked to your identity, never used for advertising, and never used to track you across other apps or websites. Firebase keeps crash reports for 90 days, then deletes them. Google's privacy policy governs how it processes this data: policies.google.com/privacy.

Premium is an optional subscription (Monthly, Yearly with a 7-day free trial, or a one-time Lifetime purchase). Prices in Vietnam are Monthly ₫49,000, Yearly ₫299,000, and Lifetime ₫599,000; prices vary by country/region and the exact price is always shown in the app before you buy. Payments are handled entirely by the App Store or Google Play — we never see your card or payment details. We use RevenueCat to manage subscription status; it stores your purchase state (which plan, active or expired) against a random app-user identifier, not your name or email. RevenueCat uses this only to unlock the features you paid for and to restore purchases. See revenuecat.com/privacy and apple.com/legal/privacy.

The free plan shows ads via Google AdMob, only inside the unlocked vault: interstitial ads when you lock the vault, after a batch import or after a slideshow (at most once every 4 minutes), and optional rewarded ads to unlock extra free storage slots or try a Premium feature for 24 hours. Premium removes ads entirely. To serve and measure these ads, the Google Mobile Ads SDK collects an approximate location derived from your IP address, device identifiers, ad interactions (which ads were shown or tapped), and crash and performance diagnostics.

On iOS, Lockboxy never asks for tracking permission, so AdMob does not receive your device's advertising identifier (IDFA). On Android, AdMob may use the Android advertising ID, which you can reset or delete in your device settings. Google's own policies govern this data (see google.com/policies/technologies/ads) — your vault content is never included or used for ad targeting.

The app only requests a permission when you use the feature that needs it, and explains why at that moment:

• Photo Library — only if you import from the in-app library picker, to browse and (optionally) remove the originals after hiding them, and to put them back when you “unhide”. Sharing photos or videos in via the Share Sheet from Photos or any other app needs no Photos permission at all.
• Camera — only if you turn on Intruder Selfie (Premium): it takes a photo and a short video of whoever enters a wrong passcode. They are stored encrypted inside the vault and are never uploaded.
• Microphone — only while you record a voice memo into the vault; recordings are stored encrypted and never uploaded.
• Files — to import documents you pick yourself, via the system file picker or the Share Sheet.

You can decline or later revoke any of these in your device Settings; the related feature simply won't be available.

The in-app Private Browser fetches the web pages you visit directly from your device to those websites; those sites are governed by their own privacy policies. Your browsing history and cookies are kept inside the encrypted vault, not shared with us, and files you download are encrypted into the vault immediately.

Lockboxy has no cloud account of ours. Tapping "Back up now" exports an encrypted backup file and opens your device's own share sheet — you choose where it's saved (your iCloud Drive, Google Drive, Files, or elsewhere). It stays encrypted throughout and we never receive a copy. This is a manual, one-tap export, not an automatic background sync — the app can optionally remind you if it's been a while since your last one.

Lockboxy has an optional “Feedback & bug report” form. Nothing is sent unless you open it and tap Send — the app never sends feedback on its own. Your vault content is never included, and the form tells you so.

When you tap Send, we receive:

• The message you type.
• Your email address, only if you enter one — used only to reply to you.
• A screenshot, only if you attach one.
• Your app version, iOS version, device type (iPhone or iPad) and app language.
• A random install identifier generated by the app. It is not linked to your Apple ID or any account, and is used only to limit spam.

Feedback is stored on our own backend, hosted by Supabase in Singapore (ap-southeast-1), and a notification with your message is forwarded to the developer's private Telegram chat. Your network IP address is kept only as a one-way hash, for at most one hour, to rate-limit submissions.

Feedback is never used for tracking, advertising or analytics, never sold or shared, and not linked to your identity.

We keep feedback until the issue is handled, then delete it; any screenshot is deleted along with the message. To have anything you sent deleted, email vanthuong.dao2004@gmail.com with roughly when you sent it and what it said (or the email address you used).

Lockboxy is not directed to children and we do not knowingly collect data from them.

We may update this policy; the effective date above will change accordingly.