1. Introduction

PasswordWallet ("we", "our", or "the App") provides a secure local password and secure note manager for mobile devices. This Privacy Policy explains what information PasswordWallet collects, how we use and protect that information, and the choices available to you.

2. Summary — key points

• By default, PasswordWallet stores your data only on your device (locally).
• Cloud backups (Google Drive) are optional and, if enabled, are encrypted locally before upload.
• We do not collect or transmit your passwords or sensitive data to our servers.
• We collect minimal diagnostic or usage data only if you explicitly enable crash reporting or analytics (optional features).
• You control your data: you can export, delete, or back up your vault at any time.

3. Information we do not collect

PasswordWallet does not collect or transmit your stored passwords, account details, or secure notes to our servers by default. We do not require an account to use the core features.

4. What the app stores locally on your device

We store the following information locally on your device:

• Vault data: entries you create (e.g., titles, usernames, passwords, URLs, notes, attachments, custom fields) — encrypted in the local database.
• Settings: local preferences such as UI choices, biometric unlock settings, and backup options.
• Optional logs: diagnostic information or crash reports if you opt-in to diagnostics.

5. Encryption & security measures

We take security seriously. Key measures include:

• Vault encryption: All sensitive data stored by the app is encrypted using industry-standard encryption (for example, AES-256) before being written to local storage. The Master Password (or an equivalent key derived from it) protects the encryption key.
• Biometric access: When you enable biometrics (fingerprint/Face ID), the device’s secure mechanisms are used. Biometrics are used only for unlocking local access and are not transmitted to us.
• Backups: If you enable cloud backup (Google Drive), the app encrypts the backup locally before uploading. The encrypted backup stored on Google Drive is not readable without your Master Password or backup passphrase.
• No plaintext transmission: The app never transmits password data in plaintext over the network.

6. Optional cloud backup (Google Drive)

Purpose: allow users to create encrypted backups for restore or migration.
How it works: backups are encrypted locally using your Master Password (or backup passphrase) before upload. The encryption key is not shared or stored on our servers. The backup file is saved to your Google Drive account and is subject to Google Drive’s terms and security.
Responsibility: You are responsible for keeping your Master Password safe. Without the Master Password, encrypted backups cannot be decrypted.

7. Crash reporting and analytics (optional)

These features are disabled by default. If you opt in, the app may collect non-sensitive diagnostic information (app version, device model, OS version, stack traces) to help fix issues. Diagnostic data will not include your vault entries or other sensitive content. You can opt-out at any time from within the app settings.

8. Permissions

The app requests only permissions required for opted-in features (for example, access to Google Drive for backups or local file access for exports). The app will request biometric or device credential permission only to enable biometric unlock functionality.

9. Third-party services

Google Drive (backup): If you enable backup to Google Drive, Google handles storage and access control per its policies. We do not hold or manage your Google credentials.
Optional third-party crash/analytics tools: if you enable diagnostics, we may use third-party services to aggregate crash reports; those services will not receive your vault data.

10. Data retention and deletion

• Local data: stored on device until you delete it, uninstall the app, or clear app data.
• Backups: stored on your Google Drive until you delete them. PasswordWallet does not automatically delete backups from your Google Drive.
• If you request deletion assistance, we will provide instructions for securely removing local data and backup files.

11. Exporting and transferring data

You can export your data to an encrypted backup or CSV via the app’s export function. CSV exports are not encrypted by default — handle them with extreme care. For migration, restore encrypted backups or import CSV as supported by the app.

12. Children and age restrictions

PasswordWallet is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe we have collected information from a child under 13, contact us to remove it.

13. Changes to this policy

We may update this Privacy Policy to reflect changes in features or legal requirements. We will display the “Last updated” date at the top of this policy. Material changes will be communicated via the app or release notes.

14. Contact us

If you have questions, requests to delete data, or privacy concerns, contact us at:
Email: your-email@example.com
GitHub: https://github.com/monchai68/PasswordWallet_Pro

15. Legal disclaimers

While we use strong encryption and follow security best practices, no software can be 100% secure. You are responsible for safeguarding your Master Password and managing backups properly. PasswordWallet is provided “as is” and we are not liable for data loss resulting from user error, device loss, or unauthorized access to backups if the Master Password is compromised.