This privacy policy explains how MySecureVault ("the App", "we", "us") handles your information. The App is developed and operated by Christopher Rutledge. MySecureVault is a zero-knowledge password manager: it is built so that nobody but you — not even us — can ever read your vault.
Your master password never leaves your device, is never transmitted anywhere, and is never stored anywhere — not in plain text, not encrypted, not even by us. It is used only, in the moment, to derive the encryption keys that unlock your vault, using the Argon2id key-derivation algorithm. If you forget it, we have no way to recover it or your vault (see the Support page for what "Erase and start over" does).
Everything you save — passwords, usernames, notes, documents, and photos — is stored in an encrypted database on your device. It is protected by two independent layers of encryption: the entire local database file (SQLCipher) and, separately, each individual item (AES-256-GCM). Neither layer can be decrypted without a key derived from your master password.
Face ID, Touch ID, and Android biometric unlock are handled entirely by your device's operating system. The App never receives or stores your fingerprint or face data itself — only a yes/no result from the OS. If you turn on biometric unlock, your master password is cached solely inside your device's secure hardware-backed storage (iOS Keychain / Android Keystore), gated behind that same biometric check, and is never transmitted off your device.
Cloud sync is optional. If you create an account — by email and password, or by signing in with Google or Apple — and turn sync on, your vault items are uploaded to our sync provider (Supabase) so you can access them on another device. They are uploaded only as ciphertext, encrypted on your device before it ever leaves it. Supabase stores your account email address to manage authentication, but never has access to your encryption keys and cannot read your vault contents.
If you sign in with Google or Apple, that sign-in step is governed by Google's or Apple's own privacy policy. The App only receives the token needed to create or access your account — no other profile data.
You can export an encrypted backup of your vault at any time. This file is created on your device and only leaves it when you explicitly choose to share, save, or transfer it yourself (via your device's share sheet or file system). The App never uploads a backup file automatically or on your behalf.
The App runs an on-device security check (freeRASP by Talsec) to detect signs of a compromised device — such as jailbreaking, rooting, tampering, or installation from an unofficial source — and blocks access if one is found, to protect your vault. If a genuine threat is detected, the App may send an alert containing device and threat metadata (for example, device model and threat type) to the developer for security monitoring. This alert never contains your vault contents, your master password, or any of your saved items.
If you enable Autofill (Android) or the Password AutoFill extension (iOS), it runs entirely on your device. It reads your encrypted vault only after you unlock it, using your device's own secure storage to share data between the App and the autofill extension. Nothing is transmitted off your device for this feature.
The App uses Supabase only if you choose to enable cloud sync, and Google Sign-In / Sign in with Apple only if you choose to use them to create your account. The App does not use any analytics services, advertising networks, or tracking SDKs of any kind.
The App does not knowingly collect any information from children under the age of 13.
If we make material changes to this policy, we will update the "Last updated" date above. Continued use of the App after any changes constitutes acceptance of the revised policy.
If you have any questions about this privacy policy, please contact us at: cjrutledge@gmail.com