Privacy Policy

Last updated: February 18, 2026

VibePass ("the App") is a password manager for Android. This policy explains what data the App accesses, how it is processed, and your rights as a user.

1. Data We Access

The App accesses the following data, all of which is processed locally on your device:

• Google Drive files — Only .kdbx (KeePass database) files that you explicitly select. The App reads and writes these files to sync your password database.
• Google Account name — Displayed in the App to show which account is signed in. Not transmitted to any external server.
• Biometric data — Used solely through the Android Biometric API for authentication. Biometric data never leaves the device's secure hardware (Trusted Execution Environment).

2. How Data Is Processed

All password database processing happens entirely on your device:

• Your master password is stored in memory as a zeroed CharArray and is never written to disk in plaintext.
• For biometric unlock, your master password is encrypted using AES-256-GCM with a key stored in the Android Keystore hardware-backed security module.
• The encrypted KeePass database (.kdbx) is read from and written to your Google Drive. The App never decrypts your database on any server — decryption happens exclusively on your device.
• Copied passwords are automatically cleared from the clipboard after 30 seconds.

3. Data We Do NOT Collect

VibePass does not:

• Collect analytics or usage statistics
• Use tracking pixels, SDKs, or third-party analytics services
• Display advertisements
• Transmit any data to our servers (we don't operate any servers)
• Share data with third parties
• Access any Google Drive files other than the .kdbx files you select

4. Data Storage

• On your device: Encrypted master password (in Android Keystore), last selected file ID, and unlock timestamp — all stored in EncryptedSharedPreferences.
• On Google Drive: Your .kdbx password database, encrypted with your master password using the KeePass standard (AES-256 or ChaCha20).
• Backup: Device backup and data extraction are disabled (allowBackup=false, dataExtractionRules block all categories).

5. Security Measures

• FLAG_SECURE: The App prevents screenshots, screen recordings, and app-switcher thumbnails.
• Auto-lock: The App automatically locks after 7 days of inactivity, requiring re-authentication.
• Memory hygiene: The master password is zeroed in memory on every lock or sign-out.
• No logging: The release build contains no debug logging that could expose sensitive information.

6. Google API Scopes

The App requests the following Google API scope:

• https://www.googleapis.com/auth/drive — Required to discover and modify your pre-existing .kdbx files on Google Drive. The App only reads and writes KeePass database files; it does not access any other files on your Drive.

7. Children's Privacy

The App is not directed at children under 13. We do not knowingly collect any information from children.

8. Changes to This Policy

We may update this policy from time to time. Changes will be reflected by the "Last updated" date at the top of this page.

9. Contact

If you have questions about this privacy policy, please contact us at:

support@vibepass.app