Privacy Policy

Overview

Vaulta is a privacy-first personal vault and money tracker. Your data is designed to stay on your device by default. This Privacy Policy explains what data Vaulta processes and how it is handled, including the Penny Flow money-tracking feature.

Data Stored On Device

Vaulta stores vault items, notes, attachment references, your Penny Flow financial entries, and app preferences locally on your device. Local data is encrypted.

Security credentials such as PIN hash/salt and encryption key material are stored using secure device storage mechanisms.

Penny Flow Money Tracking

Vaulta includes Penny Flow, a personal money tracker. Income, expenses, transfers, credit-card activity, recurring items (such as EMIs and subscriptions), locked savings (DPS), and the balances and summaries derived from them are entered by you and stored locally on your device, encrypted at rest. Bank accounts and cards used as fund sources are kept as Vault items.

Penny Flow does not connect to banks, cards, or payment networks, and does not import, sync, or read transactions from any financial institution. Your financial data never leaves your device except inside encrypted backups you choose to create.

Backups and Sync (Optional)

Google Drive backup is a Premium feature.Google Drive backup is optional and off until you turn it on. When enabled, Vaulta saves encrypted vault and Penny Flow backup data to your own Google Drive AppData folder through your Google account — a private area only this app can read. Vaulta cannot see the rest of your Drive, and the backup is encrypted before it leaves your device.

The backup is written to Drive's hidden application-data area, so it does not appear among your Drive files and no other app can read it. You can confirm it exists, see its size, and delete it at any time from Google Drive on the web under Settings → Manage apps → Vaulta. It counts towards your Google storage quota, and deleting it there permanently removes that backup.

Local encrypted .vaulta export involves no account and no network transfer.

Vaulta does not operate a central server for hosting your vault content.

Local Export Security (.vaulta)

Local backup export creates a Vaulta backup file with a custom .vaulta extension. Backup payload data is encrypted, including exported attachment content and your Penny Flow records.

Renaming the file to another extension (for example .zip) does not expose readable raw vault content.

Authentication and Security Features

Vaulta may use PIN and optional biometrics (Face ID / fingerprint) for local app unlock. Biometric templates remain managed by the operating system and are not accessible by Vaulta.

Purchases

The full version is sold through Google Play, which acts as the merchant of record and processes your payment and billing details under its own privacy terms. Vaulta never receives or stores your payment card information, your Google account email, or your name.

To unlock the app, Vaulta sends the purchase token Google Play issued, together with an identifier this installation generated for itself, to our server. The server asks Google whether that purchase is genuine and still active, and if so issues a signed confirmation the app can check offline.

Our server keeps that purchase token, which product was bought, its current status, and the installation identifier — enough to answer whether this installation is entitled and to react when a subscription is cancelled or refunded. This information is used for that purpose alone. It is not used for advertising or profiling, and it is not sold or shared with anyone.

Free trials, renewals, cancellations and refunds are handled entirely by Google Play. Manage or cancel a subscription in the Play Store at any time.

Installation Identifier

Vaulta generates a random identifier for each installation and stores it in your device's secure storage. It is used to attach a purchase to this installation and to count allowances you have earned in the app, such as extra vault items from watching a short video.

It is not a device identifier. Vaulta does not read ANDROID_ID, your advertising ID, or any other hardware or system-provided identifier. The value is created by the app, is unique to this installation, and identifies nothing outside Vaulta. Earlier versions did read a system identifier to run the free trial; Google Play now runs the trial, so that is no longer collected.

It is not linked to your name, email address, or any vault content, is not used for advertising or profiling, and is not shared with third parties. No vault or Penny Flow data is ever transmitted when the app checks it. Uninstalling Vaulta discards it; it is included in your backup so allowances you earned are restored along with everything else.

Third-Party Services

Depending on enabled features, Vaulta may use third-party services such as Google Sign-In and Google Drive APIs (backup), Google AdMob (ads), and Google Play Billing (purchases). Those services process data according to their own privacy terms.

Permissions

Vaulta may request permissions like camera, photo library, notifications, and biometrics strictly to support related app features.

Your Controls

You can edit or delete your vault items and Penny Flow records, disable optional features, remove app lock, sign out of backup providers, and uninstall Vaulta at any time.