VALID PRIVACY

Valid Vault Privacy Policy

Last updated: November 2026

Scope

This Privacy Policy covers the Valid Vault browser extension (for Chrome, Edge, and Brave) and the Valid Vault Android app, which includes a private browser. Both share the same vault, encryption, and sync code, but they run in different environments, so each point below says whether it applies to the extension, the phone app, or both the extension and the phone app.

Information We Collect

Both the extension and the phone app: Valid Vault does not collect any information. There are no servers, no backend, and no user accounts. There is no analytics, no telemetry, and no advertising, and nothing you store in Valid Vault is sent to the developer or to any third party.

Information Stored on Your Device

Both the extension and the phone app store the following on your device, encrypted with AES-256-GCM under a master key only you can unlock:

Settings are stored on the device without encryption, since they hold no secrets: the auto-lock time, QR timeout, password generator length, the key and vault name, and day or night mode. Phone app only: also when the vault locks after you leave the app and whether screenshots are allowed, and the private browser keeps its search engine choice, your new tab quick view sites, and the sites where you turned tracker blocking off.

Extension: the vault is kept in the extension's own storage in your browser profile, along with an encrypted backup copy that restores the vault if the browser clears site data. When you submit a login form, the captured login is held in the browser's session memory for up to 45 seconds so the save prompt can survive a sign-in redirect. It is cleared when you answer the prompt, when the vault locks, or when the browser closes.

Phone app: the vault is kept in the app's private storage. The app's data, including the vault, its settings, and the private browser's data, is left out of Android backups and device-to-device transfers. Fingerprint keys stay in the phone's hardware keystore.

Permissions

Extension: each permission is used on your device only, to operate as a password manager:

The extension's own pages are blocked from making network requests by the extension's content security policy, so the popup, Manage, the unlock window, and the bookmarks panel cannot connect to any server.

Phone app:

Phone app: when you share a link to Valid Vault from another app, it is saved as an encrypted bookmark. Home screen widgets and shortcuts only open the app and ask for your fingerprint or device PIN; they show no vault contents.

Private Browser

Phone app only: the private browser loads pages directly from the websites you visit, like any browser, so those sites receive your requests and see what any site sees, including your IP address unless you use Tor mode or a VPN. Your browsing is never sent to the developer.

Activity and Auto-Lock

Extension: to keep the vault open while you are using your browser, the extension notes that real mouse, scroll, click, or key activity happened and resets the auto-lock timer. It does not record what you typed, what you clicked, or where. Only the time of the last activity is kept, in memory, and it is cleared when the browser closes.

Phone app: the auto-lock timer resets when you use the app, and the vault also locks after you leave the app, after the time you choose in Settings. Only the time of the last activity and the moment you left are kept, in memory.

Device-to-Device Sync and Files

Both the extension and the phone app: the vault moves between your own devices by QR code or by an exported file. One device shows the encrypted vault as a QR code and the other scans it, or you save the encrypted file and open it on the other device yourself. The vault stays encrypted throughout, and the master key only leaves a device wrapped under a passphrase, plus three additional answers you choose. No server or outside service is involved.

Both the extension and the phone app: import files from other password managers are read on the device and encrypted straight into the vault. Valid Vault never writes passwords to a file unencrypted.

Extension only: Uni-Vault links the browsers on one computer to an encrypted vault file you pick, which Valid Vault reads and writes through the browser's file access. The file stays encrypted and stays where you put it.

Phone app only: an exported file can be saved to Downloads or sent with Android's share menu. If you send it to another app, that app handles the file from then on. The file is encrypted and useless without your master key.

Third Parties

Both the extension and the phone app: Valid Vault does not share information with third parties and contains no advertising, analytics providers, or outside services that receive your information.

Phone app only: websites you visit in the private browser, the search engine you choose, and Orbot in Tor mode receive the requests needed to load what you asked for, as with any browser. Valid Vault does not send them anything from your vault, except a login or personal detail you choose to fill into that site.

Data Retention and Deletion

Both the extension and the phone app: all data stays on your device under your control. Clear Vault in Settings deletes the vault and your unlock methods.

Extension: Clear Vault also deletes the encrypted backup copy, and removing the extension deletes everything it stored.

Phone app: uninstalling the app deletes everything it stored on the phone. Files you exported stay wherever you saved or sent them until you delete them.

Children's Privacy

Both the extension and the phone app: Valid Vault is a general-purpose application and is not directed at children. It does not collect personal information from any user; anything entered stays encrypted on the user's own device.

Changes to This Policy

Any changes to this policy will be posted on this page with an updated date.

Contact

Valid Vault is published by Rook. Questions about this policy can be sent to byrook@proton.me. The source code is available on GitHub.

Valid VaultUser Guide