Vault Secure ("VAULT", "the app") is designed so that your passwords, passkeys, cards, documents, and identities stay encrypted on your own devices. The developer does not run any server, does not collect your data, and — by design — cannot see what you store.
None. Vault Secure has no user accounts and no backend server operated by the developer. We do not collect personal information, usage analytics, diagnostics, location, contacts, or identifiers. There is no registration and nothing is transmitted to us.
All vault content — passwords, passkeys, two-factor (2FA) secrets,
payment cards, documents, secure notes, and identity records — is stored
locally on your device and encrypted using AES-256-GCM.
The encryption key is derived from your Master Password (which is never stored)
and protected in the iOS Keychain / Secure Enclave. Face ID / Touch ID is used
only to unlock the app on your device.
If you enable iCloud sync or the iCloud Drive backup, the app stores an already-encrypted copy of your vault in your own private Apple iCloud (CloudKit private database and/or iCloud Drive) so it can sync between your devices. Data is encrypted on your device before it is sent, so neither Apple nor the developer can read it. This feature is governed by Apple's Privacy Policy. You can turn it off at any time in the app's Settings.
When you enable Password AutoFill or the "Save from Safari" extension, credentials are read or written only on your device to fill a login or to offer to save one you just entered on a website. Captured logins are held in an encrypted, on-device queue and imported into your vault. Nothing from these features is sent to the developer or any third party.
Vault Secure can create, store and use passkeys — the passwordless sign-in standard. A passkey is a pair of cryptographic keys: the website keeps the public half, and the private half stays in your vault, encrypted like everything else. When you sign in, the app proves who you are by signing a one-time challenge with that private key, after Face ID / Touch ID. The private key is never sent to the website, to Apple, or to the developer — only the signature is, and it cannot be reused.
Everything below happens only when you start it, and always goes where you choose — never to the developer.
Transfers between apps. On iOS 26, Vault Secure supports the system's Credential Exchange feature in both directions: you can bring passwords and passkeys in from another password manager, and you can send them to one. The transfer is handled by iOS directly between the two apps, encrypted in transit, with no copy going anywhere else.
CSV import and export. For compatibility with managers that don't support the system transfer, the app can read and write CSV files. A CSV file is plain text and is not encrypted — anyone who opens it can read your passwords. Vault Secure writes it only when you ask, hands it straight to the share sheet you pick, and deletes its temporary copy afterwards. Once the file leaves the app it is your responsibility: send it somewhere safe and delete it as soon as you are done.
Encrypted backups. The backup file the app exports stays encrypted with your passphrase and is safe to store anywhere.
The app asks for camera access for one purpose: scanning a QR code when you add a two-factor authentication code. The image is read on your device and used only to extract that setup key. No photo is taken, saved, or transmitted, and the app never accesses your photo library.
Vault Secure contains no third-party analytics, advertising, or tracking software. We do not sell, rent, share, or transmit your data to anyone — there is nothing on our side to share, because we never receive it.
You are always in control. Delete individual items in the app, or use Settings › Delete Vault Permanently to erase everything, including the option to remove the iCloud copy. Deleting the app removes its on-device data; any iCloud data can also be removed from your device's iCloud settings.
Vault Secure is not directed to children under 13 and collects no personal information from anyone, regardless of age.
If this policy changes, the "Last updated" date above will change with it. Material changes will be reflected here on the same URL.
Questions about privacy or this policy? Reach the developer at shaan.geek@gmail.com.