HushVault Privacy Policy

Effective date: October 26, 2026 · Contact: dtechx944@gmail.com

This policy covers the HushVault Android app and the HushVault Chrome extension.

HushVault for Android

Summary

HushVault is an offline encrypted vault. There are no accounts, no HushVault servers, no analytics, no ads and no tracking SDKs. Your photos, videos, PDFs and folders are encrypted and stay on your device.

Data the app handles

Vault content (photos, videos, PDFs, folder names): encrypted on the device with keys protected by the Android Keystore. Never sent to us; we have no servers.
PIN / password and biometrics: your unlock secret is used only on the device to derive/unlock keys. Fingerprint/face unlock uses the Android BiometricPrompt; HushVault never receives your biometric data.
Camera: the secure camera uses the system camera app through an Android intent writing to a private, app-only file location. HushVault does not request the CAMERA permission.
Import / export: files are chosen through the Android system file picker (Storage Access Framework). HushVault does not request broad storage permission.
Backups (.hvbk): optional, encrypted files that you create and keep wherever you choose. We never receive them. The HushVault Chrome extension can read/write the same format locally.

Purchases

The one-time “HushVault Pro” unlock is processed by Google Play Billing (permission com.android.vending.BILLING). Payment details and the purchase record are handled by Google under the Google Privacy Policy. HushVault only checks on-device whether Pro has been purchased.

Network access

HushVault's own code makes no network requests. The Google Play Billing library includes the INTERNET and ACCESS_NETWORK_STATE permissions, and Google libraries may send diagnostic data to Google as part of billing. HushVault code does not use the network.

Children

HushVault is not directed at children under 13.

Data deletion

Uninstalling the app deletes all vault data on the device permanently (unless you kept your own .hvbk backups). There is no account to delete.

HushVault Chrome Extension

No accounts, no HushVault servers, no analytics, no ads, no remote code.
Your vault (photos, videos, PDFs) is encrypted with AES-256-GCM in your browser and stored locally (IndexedDB / chrome.storage.local) on your computer. It is never sent to us.
Your password never leaves your browser and is not stored in plain text.
Web capture: when you right-click an image/video/link and choose “Encrypt & Save to HushVault”, the extension asks for permission for that one site, then downloads that one file directly from that site (no cookies sent) and encrypts it locally. That is the only network request the extension makes.
Backups (.hvbk): optional encrypted files you save and keep; compatible with the HushVault Android app. Never uploaded by us.
No data is sold or transferred to third parties, and none is used for purposes unrelated to the vault, creditworthiness or lending.
Uninstalling the extension deletes its local data.

Changes

We will update this page and its effective date if anything changes.