Privacy policy

Effective 5 October 2026

This policy explains what data Vault Safe ("the app") handles, why, where it is stored and the choices you have. Vault Safe is a personal project developed and operated by Rajshree Pindolia, Bhuj, Kutch, Gujarat, India ("we", "us" in this policy). Contact: privacy@sanchaylabs.app.

In short: you choose what to store; secrets and files are encrypted on your device before upload; we do not sell your data, show ads or use your data to train AI models.

1. Data we handle

Data	Why	Encrypted on your device?
Account email address and account password	To sign you in. The password is stored by our hosting provider only as a secure hash.	No (needed for sign-in)
Usernames, passwords and notes in credential and console items; API keys and .env contents; secure notes; key-file passwords	To store them for you	Yes
Files you upload (key files, app builds, documents, Chrome bookmarks exports)	To store them for you	Yes
Project names and descriptions; item titles, tags, link URLs, console URLs, project/app IDs, build version labels; file names, sizes and dates	To organise, display and search your vault	No
Backup records: folder name, the folder's path on the computer where it was added, that computer's name, exclusion list, backup dates, sizes and status	To run and show weekly backups	No
Backed-up file names and file contents	To restore your files	Yes (file names are also replaced by keyed fingerprints)
Your master password	To create your encryption key	Never stored or sent anywhere. We store only a random salt, the key-derivation settings and an encrypted check value.

We do not use analytics, advertising or tracking tools, and we do not collect your location or contacts.

2. Data received from Google (Google Drive)

Connecting Google Drive is optional and is used only by the desktop app's weekly backup feature.

Access requested: the drive.file scope, which allows the app to create, read, update and delete only the files and folders it creates itself. The app cannot see or access any other file in your Google Drive. The app also reads your Google account email address to show which account is connected.
How we use it: to create a "Vault Safe Backups" folder, upload your encrypted backup files to it, download them when you restore, and delete old versions and backups you remove. Nothing else.
Where it is stored: backup files are stored in your own Google Drive. Your Google sign-in tokens are stored only on your computer, in its secure credential store. They are not sent to our servers. Backup records in our database contain Google Drive file and folder IDs, but no Google content.
Sharing: we do not transfer, sell or share data received from Google with anyone, and we do not use it for advertising or to train AI or machine-learning models. No person reads it.
Limited Use: Vault Safe's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Revoking access: use Backups → Disconnect in the app, or remove Vault Safe at myaccount.google.com/permissions. Your existing backup files stay in your Drive until you delete them.

3. Where your data is stored

Supabase (database, sign-in and file storage), in its South Asia (Mumbai) region. Supabase processes this data on our behalf as a service provider.
Your Google Drive for backups, if you connect it.
Your devices: if you choose "Remember on this device", your encryption key is kept in the device's secure storage (Keychain, Keystore or Credential Manager) until you lock the vault. Display preferences and backup folder locations are kept in the app's local settings.

4. How we protect it

Your master password is turned into an encryption key on your device using Argon2id. Data is encrypted with AES-256-GCM before upload.
Database rules ensure each account can access only its own data.
All connections use HTTPS.
Copied passwords and keys are cleared from your clipboard after 30 seconds.

Important: because we never have your master password, we cannot recover encrypted data if you forget it.

5. Retention and deletion

Your data is kept until you delete it or ask us to delete your account.
You can delete items, projects and backups in the app at any time. Deleting a backup removes its files from your Google Drive.
To delete your account and all associated data, email us from your account's email address. We will delete it within 30 days.

6. Your rights

You can access, correct and delete your data in the app, and ask us to confirm what we hold, correct it, delete it or stop processing it. Under India's Digital Personal Data Protection Act, 2023, you may also nominate someone to exercise these rights for you and raise a grievance with us. Email privacy@sanchaylabs.app; we reply within 30 days. If you are not satisfied, you may contact the Data Protection Board of India.

7. Children

Vault Safe is not intended for anyone under 18, and we do not knowingly collect their data.

8. Changes to this policy

If we change this policy, we will update the effective date above. For significant changes we will tell you in the app or by email before they take effect.

9. Contact

Rajshree Pindolia, Bhuj, Kutch, Gujarat, India · privacy@sanchaylabs.app