Privacy Policy

The short version

• Your passwords, passkeys, cards, notes and other saved details are locked on your phone before anything leaves it. Our servers hold only the locked copy and cannot read it.
• We know your Google email and name (to sign you in), the phones you use, and which country your phone connects from.
• Optional and off until you say yes: anonymous usage statistics (which phone model and Android version, which screens are opened, how long the app is open, whether someone signed in or saved a first item). They are never tied to your account or email, and you can turn them off and delete them any time in Settings, Usage statistics.
• We never use GPS or your exact location, and we do not sell your data or show ads.
• You can delete your whole account from inside the app: Settings, then Delete my account.
• If you lose your phone, you get back in with your recovery code, which is also saved with your Google account (and, if you choose, on a USB drive).
• On by default, and you can turn it off: Support recovery. Vaukt keeps a locked spare of your vault key that only Vaukt's admin console can open. If you lose everything and ask for help, the admin checks that it is you, approves, and your vault opens on your new phone after 24 hours, unless you cancel from a phone you still trust. You can turn it off when you create your vault or any time in Settings, which deletes the spare. With it off, Vaukt keeps no copy of your vault key, not even a locked one, and if you lose your phone, your recovery code and its Google copy, nobody, including us, can open your vault.

Who we are

Vaukt is a side project built and run by an individual developer in India. In this policy "we" means that developer. Contact: admin@pakkawork.com, phone +91 9059256132, or the Help section in Settings (WhatsApp or email).

What we collect and why

• Account: your Google email address, name and Google profile picture, so we can sign you in and show who you are. You can set your own name and picture; a picture you choose stays on your phone and is never uploaded to us.
• Your vault: your saved items, locked with keys that only your phones hold. We store the locked data, the locked key copies for each of your phones, and a locked recovery copy that your recovery code can open.
• Your phones: for each phone we keep its name, system and version, app version, its public keys, whether it is trusted, when it was added and last seen, and the two-letter country it connects from (taken from the connection, we do not keep the address).
• Usage statistics (optional, only if you say yes in the first-run question or in Settings, Usage statistics): a random install code that is not linked to your account, your phone's make and model, its Android version and language, the app version, whether the app came from Google Play, the country your phone connects from (read by our server from the connection; the address is not kept), the names of the screens you open, how long the app stays open, and plain counts such as "signed in", "created a vault", "saved a recovery code" or "saved an item". Never your name, email, passwords, passkeys, login codes, item names, vault contents, advertising id or location. Saying no, or choosing Delete my statistics, erases what we hold for that install code. Earlier versions of Vaukt stored how long the app was open against your account; that is no longer collected, and the old records are erased when you delete your account.
• Security log: a record of events on your account (a phone signed in, a vault created, a recovery requested) with the time, so you can see activity and we can spot abuse.
• Website early access: if you ask for early access on our website, we keep your email address, name, the sign-in provider you used and the time, only to write to you about the app, until you ask us to delete it or the app is released and you have been told. Write to the contact below to be removed.
• Website statistics: see "Cookies and tracking" below.
• Share and waitlist counts: when you tap Share Vaukt in Settings, or Join or Share on the AI waitlist, the app adds one to a count on our server. Only which button was tapped, a short link tag (for example "app-share") and the time are kept. No account, name, email or device is sent with it. The links you share carry the same tag so we can see which one brought someone.
• Abuse protection: your internet address is used for short-lived rate limits and is deleted within a few hours. Our hosting provider also keeps its own technical logs.
• Support recovery spare (unless you turn it off): your vault key, locked so that only the Vaukt support key can open it, and the requests you make for help, with the time. Kept until you turn it off or delete your account.

What stays only on your phone

• Camera pictures and scans are read on the phone by Google ML Kit. They are never uploaded. A photo is kept only if you attach it to an item, and then it is locked like everything else.
• Your fingerprint or face is handled by Android. We never receive it.
• Your recovery code is also kept by Google Play services on your phone (Google's Block Store), so you can open your vault again after signing in with the same Google account without typing it. Only the Vaukt app can read it. It is copied to your Google account's backup only when that backup is end-to-end encrypted with your phone's screen lock, so Google cannot read it; otherwise it stays on your phone. We never receive it. Deleting your account removes it.
• Item titles, usernames and website names are kept in the app's private storage on your phone so the app can show them quickly.

Who else is involved

• Supabase hosts our database, sign-in and file storage (servers in Singapore). Vercel hosts our websites. PostHog processes website statistics only for visitors who accepted them.
• Google provides Sign in with Google and your profile picture.
• Website and app logos: to show a logo next to a login or an app, the app asks the website itself, Google Play (for an app's icon, using only the app's package name), Google's icon service, DuckDuckGo's icon service or icon.horse, using only the website address or app name. This can show those services which websites or apps you use. You can turn this off in Settings, and the app then shows a letter instead.
• Password check-up: to see whether a password appeared in a known leak, the app sends only the first five characters of a one-way hash of it to the Have I Been Pwned range service (api.pwnedpasswords.com). The password itself never leaves your phone, and the service cannot tell which password you checked.
• Login-code and passkey lists: the app downloads public lists of which websites support two-step codes and passkeys (api.2fa.directory and passkeys-api.2fa.directory). Nothing about you is sent.
• App links: before filling a passkey for an app, the app downloads that website's public digital asset links file (/.well-known/assetlinks.json) to check that the app belongs to it.
• If you add your own key for an email-alias service (SimpleLogin, addy.io, Firefox Relay or DuckDuckGo), the app talks to that service only when you ask it to.
• If you contact us on WhatsApp or by email, that service handles the message under its own policy.

We do not sell personal data and we do not use advertising or tracking services.

Features that are not in this version

This version of Vaukt keeps passwords, passkeys and login codes only. Its AI section is a preview: example messages and the waitlist, with nothing sent to an AI model. The AI agent, connected apps, outside agents, the web console, live screen and phone control, and sharing items with other people are not available in it: they are switched off in the app, nothing for them is collected, and Vaukt does not use Android's Accessibility service or screen sharing. If we add any of them later, we will update this policy first, tell you in the app, and ask for your consent before anything new is collected. Emergency access (letting a trusted person open your vault) has been removed from the Vaukt app.

Cookies and tracking

• The app: no advertising identifiers, no advertising or third-party analytics tools. The only measurement is the optional, anonymous usage statistics described above, sent to our own server.
• Our website (vaukt-website.vercel.app): the first time you visit it asks you to Accept or Decline statistics, with equal prominence. Declining keeps the site working exactly the same and stores nothing in your browser. If you accept, the site stores a random visitor code in your browser and records which pages and sections you view, how long you stay and how far you scroll, the site or link tag that brought you, your device type, browser, operating system and language, and your country and region (state) read from the connection (never your city or internet address). This is sent to our own server and to PostHog (an analytics service, US servers, under its own terms and our instructions), which receives the same page and section events and a random code, and, like any web service, the internet address of the request, which it uses to work out the country and region. You can change your mind with the Cookie choices link in the website footer, which also deletes the statistics for your browser.
• Downloads: when you download the app from our website we add one to a count with the country only, with no visitor code, whatever you chose above.
• We keep website and app statistics for up to 400 days and then delete them automatically.
• Our legal web pages set no other cookies. When you open a website in Vaukt's own browser, that website may set cookies for itself, under its own policy. Vaukt clears them, and the other page data, when you close the browser.

How long we keep things

We keep your data until you delete your account. When you delete your account we erase your vault, phones, recovery data, security log, picture and sign-in from our servers. Anonymous usage statistics are not tied to your account, so delete them separately with Delete my statistics in Settings (or they expire after 400 days). Backups kept by our hosting provider may hold the data for a limited time before they expire.

Our role, our legal bases and what we keep for how long

• Our role: for the account data described above we decide why and how it is processed, so we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 and the controller under the GDPR and UK GDPR. You are the Data Principal or data subject.
• Legal bases (GDPR): your consent (for each optional feature), and the contract with you (to run the vault, sign-in and sync you asked for). Under Indian law the basis is your consent, and, for a few things, uses the law allows without consent, such as complying with the law.
• What we keep, and for how long:

- Your vault, phones, recovery data, security log and sign-in: until you delete your account, then erased.

- Anonymous usage statistics (app and website): up to 400 days, or until you delete them or withdraw consent.

- Replay-protection records for signed requests: about 15 minutes.

- Rate-limit counters (they hold an internet address in short form): about 2 hours.

- Phones that started signing in but never finished: removed after 24 hours.

- Website early-access list: until you ask to be removed, or the app has launched and you have been told.

- Records the hosting provider keeps in its own backups and logs: for a limited time under its own policy.

• Automated decisions: we do not make decisions about you by automated means that have legal or similarly significant effects, and we do no profiling.
• International transfers: our hosting is in Singapore and your data may also be handled by Google. These providers protect it under contracts and standard safeguards. Under the DPDP Act, transfers to countries the Indian Government has not restricted are permitted.

Consent and how to withdraw it

We process your data on the basis of your consent, which you give by an affirmative act when you create your account and when you switch on a feature that needs more (logo lookups and the password leak check). Each of these has its own switch in Settings. You can withdraw consent at any time as easily as you gave it: switch the feature off in the app, remove the phone, or delete your account. Withdrawing does not undo what was done before, and some features stop working without the data they need.

Your choices and rights

• Delete your account in the app (Settings, Delete my account), on the web at vaukt-website.vercel.app/delete-account, or by asking us by email or phone. Deletion is permanent: it is not a pause or a freeze. You can also remove a phone, change your name or picture, and sign out and erase a phone at any time.
• You can ask what we hold about you, ask us to correct it, or ask us to delete it. We reply within 30 days. Because the content of your vault is locked, we cannot show it to you; the app can.
• Under Indian law (Digital Personal Data Protection Act, 2023) you have the right to access, correct and erase your data and to complain to us first, and then to the Data Protection Board of India. If you live elsewhere, your local rights also apply.

Your other rights

• India: under the Digital Personal Data Protection Act, 2023 and its Rules you may ask for a summary of your data, correction, completion and erasure, use the grievance process below, and nominate another person to exercise your rights if you die or cannot act.
• European Economic Area, United Kingdom and similar laws: our legal basis is your consent and, for running the service you asked for, the contract with you. You may access, correct, erase, restrict or move your data, object, and complain to your local data protection authority.
• California and other US states (for example under the CCPA and CPRA): in the last 12 months we collected identifiers (your email and name), internet activity and device information (the technical records above), and the locked content you store, for the purposes above. We do not sell or share personal information for advertising, we use no sensitive information for profiling, and we will not treat you differently for using your rights. You may ask what we hold, ask us to correct or delete it, and limit its use; an authorised agent may ask for you. We do not respond to a browser Do Not Track signal because we do no tracking.
• To use any right, write to the contact below. We may ask you to confirm it is you before we act.

Grievance redressal

If you have a complaint about how we handle your data, write to admin@pakkawork.com with the subject "Grievance". We acknowledge it within 3 working days and aim to resolve it within 30 days. If you are not satisfied you can approach the Data Protection Board of India, or your local authority if you live elsewhere.

Where your data is processed

Our servers are run by our hosting provider and may be outside the country you live in. Only the locked copy of your vault and the technical records described above are stored there. We do not sell data to anyone.

If something goes wrong

If a breach of personal data affects you, we tell you without undue delay, what happened, what it may mean for you and what to do. We report it to the Data Protection Board of India without delay and send the Board a detailed report within 72 hours of becoming aware of it, as the DPDP Rules require, and under the GDPR we report it to the supervisory authority within 72 hours. Our notice to you names the contact below for any questions. Because the content of your vault is locked on your phone, a breach of our servers alone would not expose it; we would still tell you what was affected.

Security

Everything saved in your vault is locked on your phone with keys held in your phone's secure hardware and unlocked only by your fingerprint, face or screen lock. Data in transit is protected with HTTPS. No system is perfectly safe. If we find a breach that affects you, we will tell you.

Children

Vaukt is not meant for anyone under 18, and the app asks you to confirm you are 18 or older when you sign in. We do not knowingly collect data from children. If you think a child has an account, contact us and we will delete it.

Changes

If we change this policy in a way that matters, we will show a notice in the app before it applies. The date at the top always shows the latest version.

Contact

admin@pakkawork.com

+91 9059256132