🛡️ Zero-Knowledge Commitment: FamilyVault encrypts all documents and sensitive metadata directly on your device using authenticated AES-256-GCM encryption before syncing. We do not possess the decryption keys to your files and cannot access, view, share, or sell your documents.
1. Introduction
FamilyVault ("we", "our", or "the App") is committed to protecting your privacy. This Privacy Policy describes how your information is collected, used, and safeguarded when you use our mobile application and related services.
2. Information We Collect
A. Account Information
- Email Address & Display Name: When registering via email or signing in with Google, we collect your email address and display name to identify your account and authenticate device sessions.
- Authentication Tokens: Secure OAuth tokens used to communicate securely with authentication servers.
B. Encrypted Vault Documents & Metadata
- Encrypted Binary Blobs: All uploaded files (PDFs, images, identity documents) are encrypted locally using AES-256-GCM authenticated cipher before transmission or storage.
- Wrapped Key Envelopes: Cryptographic document encryption keys (DEKs) sealed exclusively for authorized recipients.
- Encrypted Metadata: Document titles, categories, and tags are encrypted on-device.
C. Device & Security Information
- Device Identifiers: A locally generated device ID to coordinate multi-device synchronization and session authorization.
- Biometric Credentials: Biometric authentication (fingerprint/face unlock) is handled exclusively by the Android operating system hardware keystore (BiometricPrompt API). The App never receives, stores, or transmits your biometric data.
3. Information We Do NOT Collect
- We do NOT collect unencrypted copies of your documents.
- We do NOT collect or store your vault master password or plaintext cryptographic keys.
- We do NOT track your precise physical GPS location.
- We do NOT sell, rent, or monetize your personal data to third parties, advertisers, or data brokers.
4. How We Use Your Information
- To authenticate your identity across your devices.
- To synchronize your encrypted document vault across authorized family members and sessions.
- To generate localized audit and activity logs so you can review vault access history.
- To safeguard the integrity and security of your account and files.
5. Third-Party Services
FamilyVault utilizes reputable infrastructure providers strictly for core functionality:
- Google Sign-In & Firebase Authentication (Google LLC): Facilitates secure user account creation and OAuth authentication. Privacy Policy: Google Privacy Policy.
- Android Biometric & Keystore API: Used locally on your device for hardware-backed key protection and quick unlock.
6. Data Storage, Retention & Deletion
- Retention: Your encrypted data is stored only as long as you maintain an active account.
- Document Trash: Soft-deleted documents can be restored or permanently removed at your discretion.
- Account Deletion: You have the unconditional right to delete your account and all associated data at any time. When deleted, all account profiles, device sessions, encryption envelopes, and stored encrypted documents are permanently destroyed.
- Web Deletion Portal: You can request account deletion directly within the App or via our Account Deletion Request Page.
7. Security Measures
We implement industry-standard cryptographic engineering:
- Authenticated AES-256-GCM symmetric encryption for all document payloads.
- Argon2id key derivation function for master keys.
- Hardware-backed storage for cryptographic seeds via Android Keystore.
- TLS 1.3 encrypted transport for all network traffic.
8. Children's Privacy
FamilyVault is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date.
10. Contact Us
If you have any questions, inquiries, or privacy concerns regarding FamilyVault, please reach out to us: