Zubair built the VaultZ app as a Free app. This SERVICE is provided by Zubair at no cost and is intended for use as is.
App Purpose & Core Functionality: VaultZ is a privacy and security utility application for Android. Its primary purpose is to allow users to securely lock installed applications and hide private files (photos, videos, documents). VaultZ uses the Google Drive API (drive.file scope) solely to enable users to create and restore encrypted, offline backups of their own vault data to their personal Google Drive account. We do not collect, read, or store any personal Drive data on our servers. The app functions primarily as a local, fully offline secure vault on your device.
1. Information Collection and Use
VaultZ is designed with your absolute privacy as the core principle. The app functions as a fully offline, local secure vault on your device.
We do not collect, store, transmit, or upload any of the following to any external server:
- Your private photos, videos, documents, audio files, or secure notes
- Your vault PIN, password, or biometric data
- Your app usage patterns or file access history
- Your in-app browser history, search queries, or cookies
All files secured using VaultZ are AES-256 encrypted and stored exclusively on your device inside the app's private, sandboxed storage directory — inaccessible to other apps.
VaultZ displays advertisements supplied by Google AdMob to support the free version of the app. Ad serving may involve limited technical data being shared with Google, as described in Section 8 below. None of your vault content, PINs, or biometric data is ever shared with AdMob or any advertising network.
2. How Your Data Is Stored & Secured
VaultZ uses multiple layers of on-device security:
- AES-256 CBC Encryption with PBKDF2 key derivation (100,000 rounds) for all vault backups
- Flutter Secure Storage (backed by Android Keystore / AES-GCM) for all sensitive keys, PINs, and credentials — never stored in plain text
- Hive encrypted database for vault metadata
- FLAG_SECURE (screenshot & screen-recording protection) enabled by default across all vault screens
- Decoy Vault — a fake vault mode activated by a separate PIN, designed to protect your real data under coercion
- Intruder Detection — captures a front camera photo on repeated wrong PIN attempts; these photos are stored locally only in the app's private directory, encrypted via Secure Storage, and are never uploaded
3. Permissions We Request
VaultZ requests only the permissions strictly necessary for its core functionality:
| Permission |
Why It's Needed |
| Storage Access (Read/Write) |
To import photos, videos, audio, and documents into the encrypted vault and restore them to your device |
| Camera |
Two purposes: (1) Optional — capture media directly into the vault; (2) Automatic — silently photograph intruders on repeated wrong PIN attempts (stored locally only) |
| Biometric / Fingerprint |
Used strictly on-device to unlock the vault and authenticate password resets. Biometric data never leaves your device |
| Usage Access (Accessibility Service) |
Required for the App Lock feature to detect which app is in the foreground and overlay the lock screen. No app usage data is collected or transmitted |
| Display Over Other Apps |
Required for the App Lock overlay to appear on top of locked third-party apps |
| Battery Optimization Exemption |
Required to keep the App Lock service running reliably in the background |
| Internet |
Required for the optional Google Drive cloud backup feature, the built-in Ghost Browser, and to display ads. The core vault works entirely offline |
| Package Query (QUERY_ALL_PACKAGES) |
Required to display your installed apps list in the App Lock screen so you can choose which apps to lock |
4. Cloud Backup (Optional Feature)
VaultZ offers an optional Google Drive backup feature. If you choose to use it:
- You will be asked to sign in with your Google account via Google Sign-In
- Your vault backup file is AES-256 encrypted on your device before upload — Google and we cannot read its contents
- Only you, with your vault PIN, can decrypt the backup
- We do not store your Google account credentials. Authentication is handled entirely by Google's official SDK
- You can revoke VaultZ's Drive access at any time from your Google Account settings
If you do not use this feature, no internet connection is made for backup purposes by the vault core.
5. Ghost Browser
The built-in Ghost Browser operates in incognito mode by default:
- No browsing history, cookies, or search queries are saved by VaultZ
- However, third-party websites you visit may have their own tracking mechanisms and privacy policies, which are outside our control
6. App Lock Feature
The App Lock feature uses Android's Accessibility Service to detect the foreground app and display a PIN overlay:
- No app usage data is collected, logged, or transmitted
- The list of apps you choose to lock is stored locally only in encrypted storage on your device
- The App Lock PIN is hashed (SHA-256) and stored in Android's Encrypted Shared Preferences — it is never stored in plain text
7. Recycle Bin & Data Deletion
Files deleted from VaultZ go to a Recycle Bin and are permanently and securely wiped after 3 days, or immediately upon manual deletion:
- Permanent deletion uses a zero-overwrite pass before file removal, making forensic recovery significantly harder
- Uninstalling the app or clearing its data without first restoring your files will permanently destroy your vault data with no possibility of recovery
8. Third-Party Services
VaultZ may integrate with the following third-party services:
- Google Sign-In / Google Drive API — for optional cloud backup only
- Google Play Services — for app distribution and optional in-app review prompts
- Google AdMob — used to display advertisements that support the free version of VaultZ. AdMob may collect limited technical data such as your advertising ID and device information for the purpose of serving and measuring ads. This data is handled by Google under its own privacy policy and is entirely separate from, and never combined with, your vault content, PIN, or biometric data, which always remain on your device
These services operate under their own Privacy Policies. We encourage you to review them.
9. Data Security Limitations
While VaultZ employs industry-standard encryption and security practices, please be aware:
- No method of electronic storage is 100% secure
- Security cannot be guaranteed if your device is rooted or forensically compromised at the hardware level
- Forgetting your Secret PIN with no biometric recovery set up will result in permanent loss of access to your vault data — we have no recovery mechanism by design
- ADB backups are blocked (
allowBackup="false") to prevent unauthorized data extraction
10. Children's Privacy
VaultZ is not directed to children under the age of 13. We do not knowingly collect any personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at vaultzofficial@gmail.com so we can take appropriate action.
11. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. You are advised to review this page periodically. Changes are effective immediately upon posting.