Password & Vault - Privacy Policy and Terms of Use

The Password & Vault app stores your passwords locally on your device and encrypted by default. If you choose to use the optional cloud synchronization feature, your email address and encrypted data are stored on the Firebase infrastructure. Your passwords are encrypted on the client side before being transmitted to the server; no passwords are ever collected or stored as plain-text.

2. Biometric Data and Access Security

Biometric data (Face ID, Touch ID, fingerprint, etc.) used to log into the application is processed by your device's operating system. The application cannot directly access, collect, or transmit this data to servers. It only receives information from the system on whether the authentication was successful.

3. Data Export and Import

The process of exporting or importing saved passwords is entirely at the user's discretion. The security of the device, cloud drive, or file where the exported data is stored is solely the user's responsibility.

1. Account and Data Security

Password & Vault is designed to request a PIN or biometric authentication every time it is opened. Securing the device and keeping the master PIN confidential is the user's responsibility. Due to the encryption architecture, if the PIN is forgotten, access to your encrypted data may not be recoverable.

2. Cloud Synchronization

Online synchronization is a completely optional feature. The user is responsible for protecting the email and password information associated with the account created for this feature. In case of possible network or service interruptions in the synchronization service provided via Firebase infrastructure, data continues to be stored securely locally and is synchronized once the connection is restored.

3. Disclaimer

The Password & Vault app provides a tool for users to securely organize their passwords. The developer, Serhat Taşova, cannot be held responsible for any damages that may occur in situations such as the user losing their device, unauthorized access to the device, the device being subjected to 'jailbreak' or 'root' operations, or exported data falling into the hands of third parties.

Developer Architectural Recommendation

(Security and Data Synchronization)

Since the app is a password manager, an architecture compliant with Offline-First and End-to-End Encryption (E2EE) standards should be established.

Encryption Standards: Data must strictly be encrypted on the client side before being written to the Firebase database. Derive an encryption key from the user's master PIN using a strong key derivation function (e.g., PBKDF2 or Argon2) and encrypt the data with the **AES-256-GCM** algorithm.
Key Management: Do not store encryption keys in the application code or as plain text. Isolate keys at the hardware level using Secure Enclave for iOS and Android Keystore for Android.
Repository Pattern: Establish a SyncManager structure that acts as a bridge between the LocalDataSource (e.g., SQLite, Room, or CoreData) and the RemoteDataSource (Firebase Firestore). The application should always read data via the LocalDataSource; add/update operations should be encrypted locally and sent to Firebase asynchronously (background task).