Nothing leaves your machine

Privacy Policy

Last updated: July 7, 2026 · Vault X by Hemant Suthar

Vault X ("the App") is a local-first encrypted file and note vault for Windows. Protecting your privacy is the App's core purpose. This policy explains what data the App does, and does not, collect.

1. No Data Collection

Vault X does not collect, store, or transmit any personal data. The App runs entirely offline on your device. There are no accounts, no sign-ups, no telemetry, no analytics SDKs, no crash reporters, and no third-party tracking of any kind.

All files, photos, notes, and metadata you store in the App are encrypted with AES-256-GCM and remain on your local machine. They are never sent over the network. To hide, lock, and restore files at the locations you choose (for example a document on any drive), the App requests broad file-system access; it uses this only to act on the specific files and folders you select, and never scans, reads, or transmits your files in the background.

2. Encryption

Vault X uses envelope encryption with the following layers:

• Your PIN or password derives a Key-Encryption Key (KEK) via Argon2id (a memory-hard key derivation function).
• The KEK wraps a random 256-bit Data Encryption Key (DEK).
• The DEK derives sub-keys via HKDF for the SQLCipher database and individual file blobs.
• All file content is encrypted with AES-256-GCM with unique nonces and authenticated additional data.
• Keys are held in memory only while the vault is unlocked and are zeroed on lock or app exit.

Your PIN, password, and recovery phrase are never stored on disk in plaintext. Only wrapped (encrypted) key material is persisted.

3. Network Access

The App can make one optional network request:

• Have I Been Pwned (HIBP) breach check, During setup, you may optionally check whether your chosen PIN or password has appeared in known data breaches. This uses the k-anonymity API: only the first 5 characters of a SHA-1 hash are sent to the HIBP server. Your full PIN, password, or any file data is never transmitted. This check is entirely opt-in and never runs automatically.

No other network requests are made. The App requires no internet connection to function.

4. Windows Hello

If you enable Windows Hello (fingerprint, facial recognition, or Windows Hello PIN), the App stores an opaque encrypted blob on disk that can only be decrypted by your device's Trusted Platform Module (TPM) after a successful Hello gesture. This blob contains the wrapped Data Encryption Key, never your PIN or recovery phrase. Windows Hello biometric data never leaves your device and is managed entirely by Windows.

5. Local Storage

The App stores data only in the following locations under %LOCALAPPDATA%\Vault\:

• vault.db / vault_decoy.db, SQLCipher-encrypted databases
• keystore.json, Wrapped (encrypted) key material
• settings.json, App preferences (theme, lock timeout, stealth mode settings)
• store/, Encrypted blob files for large vaulted items
• logs/, Crash logs (no personal data, paths are redacted before writing)

All stored data is encrypted at rest with keys derived from your PIN or recovery phrase. No unencrypted file content is ever written to disk.

6. Third-Party Services

The App uses no third-party analytics, advertising, crash reporting, or tracking services. The only external service ever contacted is the Have I Been Pwned API (described in Section 3), and only with your explicit, opt-in action.

7. Data Deletion

You are always in control of your data and can erase it completely:

• In the app: Settings → Danger Zone → "Erase all data" permanently deletes your keystore, databases, encrypted files, notes, settings, and logs.
• Manually: delete the %LOCALAPPDATA%\Vault\ folder to erase everything immediately.
• On uninstall: if you installed the standalone (non-Store) build, uninstalling asks whether to also erase your vault data, it is kept by default so you can reinstall and unlock again. The Microsoft Store build does not remove this data automatically, so use the in-app "Erase all data" option (or delete the folder) if you want it gone.

8. Children's Privacy

The App is not directed at children under the age of 13. It does not collect any personal information from any user, including children.

9. Changes to This Policy

If this policy changes in the future, the "Last updated" date at the top will be revised. Since the App does not collect data and cannot notify users of changes, you are encouraged to review this page periodically.

10. Contact

If you have questions about this privacy policy or the App's data practices, please contact:

Hemant Suthar
Email: hemantsuthar2810@gmail.com
Microsoft Store Publisher: Hemant Suthar