Kitelux- Your vault is stored only on your phone, encrypted.
- We run no servers and cannot see, recover or reset your data or master password.
- No ads, no analytics, no crash-report services, no trackers.
- Two optional features use the internet: Google Drive backup and the password breach check. Both are off until you use them.
1. Who we are
KiteVault is an offline-first password manager for Android (package
com.kitelux.kitevault), developed by Kitelux ("we", "us"). This policy
explains what happens to your information when you use the app.
2. Data we collect
We do not collect any personal data. Kitelux has no servers that receive your vault, your passwords, your email address, your device identifiers or your usage. The app contains no analytics, advertising, tracking or crash-reporting libraries, and we do not use any of them.
3. Data stored on your device
The information you put into KiteVault (logins, notes, folders, 2FA secrets, settings) is saved in a single encrypted file in the app's private storage on your phone.
- It is encrypted with AES-256-GCM. The key is derived from your master password with Argon2id.
- Your master password is never stored, anywhere, and never leaves your phone.
- Decrypted data is held in memory only while the vault is unlocked and is cleared when it locks.
- Android's automatic cloud backup is switched off for the app, so the vault is not copied to your Google account unless you use KiteVault's own Drive backup below.
- We cannot recover your data. If you forget your master password and have no recovery key, the vault cannot be opened by anyone, including us.
If you export your vault to a file (for example CSV or PDF), that file is not encrypted. You choose where it goes and you are responsible for it.
4. Optional network features
KiteVault makes network requests only when you use the two features below. There are no other network calls.
Google Drive backup (optional)
If you turn on backup, you sign in with your Google account and allow the narrow
drive.appdata permission. KiteVault can then upload your
already-encrypted vault file to a hidden application-data folder in your
own Google Drive, and read it back when you restore. We cannot see inside this folder
from outside the app, and the file is unreadable without your master password. The data
goes directly between your phone and Google; it does not pass through Kitelux. Google
handles it under its own
Privacy Policy. You can
sign out or delete the backup at any time from the app or from your Google Account.
KiteVault's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Password breach check (optional)
When you run the breach check, KiteVault asks the Have I Been Pwned "Pwned Passwords" service whether a password appears in known data breaches. It uses k-anonymity: the password is hashed (SHA-1) on your phone and only the first 5 characters of the hash are sent. The service returns a list of matching hash endings and the comparison happens on your phone. Your password, its full hash and which entry it belongs to are never sent. As with any internet request, the service can see your IP address.
5. Permissions the app uses
| Permission / feature | Why |
|---|---|
| Camera | Only to scan a 2FA (TOTP) QR code when you add one. Images are processed on the device and are not saved or sent anywhere. |
| Biometrics | Optional fingerprint or face unlock, handled by Android. KiteVault never receives or stores your biometric data. |
| Autofill service | Optional. If you enable KiteVault as your Android autofill provider, it can offer matching logins in apps and browsers. Matching happens on the device; nothing is sent off it. |
| Clipboard | Used when you copy a password or code. KiteVault clears it automatically after a short delay. |
| Internet | Only for the two optional features in section 4. |
6. Sharing and selling
We do not sell, rent, trade or share your information, because we do not have it. We do not use any advertising or data-broker services.
7. Retention and deletion
Your data stays on your phone until you delete it. You can erase the vault from Settings in the app, or by uninstalling KiteVault, which removes its private storage. A Drive backup, if you made one, stays in your Google Drive until you delete it there or from the app. Because Kitelux holds no copy, there is nothing for us to delete on request.
8. Security
We use vetted, widely reviewed cryptographic libraries and never custom cryptography. No software is perfectly secure: a strong, unique master password, a locked phone and an up-to-date Android are important parts of your protection. If you find a security issue, please email [email protected].
9. Children
KiteVault is not directed at children under 13, and we do not knowingly collect information from anyone, including children.
10. Changes to this policy
If we change how the app handles data, we will update this page and its effective date before the change ships. Material changes will also be described in the app's release notes.
11. Contact
Questions about privacy? Email [email protected].