← Safe Keeping · Delete your data

Safe Keeping Privacy Policy

Last updated: October 20, 2026

This policy explains what information the Safe Keeping app and its online services handle, why, and the choices you have. Safe Keeping is made by [Pixel Perfect Studios] ("we", "us"). Safe Keeping was built so that we can't see your passwords, and this policy explains how.

1. Your passwords

Everything you save in Safe Keeping (website and app names, usernames, passwords, notes, your recovery key and the names of family members you've added) is stored inside the app on your phone, encrypted.

• Your information is encrypted with AES-256-GCM using a random key.
• That key is locked with your main password, strengthened with Argon2id, and separately with your recovery key and with each family key.
• Your main password, recovery key and family keys are never sent to us or anyone else.

We never receive your passwords in a form anyone can read.

2. Backups

Every backup is a locked copy. Nobody, including us, Google and our service providers, can open it without one of your keys.

Automatic cloud backup (on unless you switch it off)

After you make a change, the app uploads a locked copy of your passwords to our server (Google Firebase). This copy:

• can only be opened with your recovery key or a family key. It doesn't contain the lock for your main password, so a weak or guessed main password can't open it;
• is stored under a code worked out from your key. We store a scrambled (hashed) check value so that only someone with the key can replace, download or delete it. We never receive the key itself;
• isn't linked to your name, email address, phone number or Google account.

One copy is kept for your recovery key and one for each family key. Together with the copy, we keep the time it was last updated and a random code the app creates for your phone, so that clearing out an old phone doesn't delete a backup your new phone is keeping up to date. To stop people filling our server with junk, we also count how many new backups each internet address starts per day, using a scrambled (hashed) form of the address, and delete these counts the next day. When you remove a family member or make a new recovery key, the old copy is deleted. When you switch cloud backup off in Settings, or use "Delete all my passwords", every copy is deleted from our server. If your phone is offline at the time, they're deleted the next time the app starts with an internet connection. A copy that another of your phones has updated since is left in place for that phone.

Android's backup to your Google account

Your phone can back up the app to your own Google account. Only the locked passwords file and the app's settings are included, and only when Android can encrypt the backup end to end with your phone's screen lock. This backup is run by Google under Google's privacy policy. We don't receive it.

Backup copy in Google Drive (optional)

If you choose a place such as Google Drive in Settings, the app saves the locked file there through Android's file picker. The storage app (for example, the Drive app) does the uploading, and we don't receive the file.

Phone screen-lock recovery (optional, off unless you turn it on)

If you turn this on, the key to your passwords is stored with Google Play services ("Block Store"), end-to-end encrypted with your phone's PIN, pattern or password, so it can be restored on a new phone. We don't receive it.

3. Fingerprint, face and screen lock

Fingerprint unlock uses Android's secure biometric system. Your fingerprint or face is checked by your phone and never reaches the app or us. The app only learns whether the check passed.

4. Filling in passwords (autofill) and copying

If you turn on autofill, Android shows Safe Keeping the sign-in boxes on the screen so it can offer the right password. This happens entirely on your phone; nothing about the apps or websites you use is sent to us. When you copy a password, the app clears it from the clipboard after 30 seconds and marks it as sensitive, so it isn't shown in clipboard previews.

5. Purchases (Plus, Premium and Lifetime)

Payments are handled by Google Play. We don't receive your name, email address or payment details. To check that a purchase is real, paid for and hasn't been refunded, the app sends our server:

• the purchase's Google Play receipt code ("purchase token") and the product bought;
• a random install code created by the app (not linked to your identity).

We check these with Google and keep a scrambled (hashed) copy of the receipt code, the result of the check, the install codes that used it, and Google's list of refunded or cancelled purchases.

6. Private email addresses (Premium, optional)

If you choose to use private email addresses, we keep:

• your real email address, encrypted, so we know where to pass emails on;
• the private addresses you've made, whether each one is switched on, and how many emails each one has passed on;
• a reference to your Premium purchase (encrypted receipt code), so we know the feature is included;
• a short-lived code we email you to confirm your address, stored scrambled and removed once used.

The website names and notes you add to each private address stay on your phone; we don't know which websites you use them for.

When an email arrives for a private address, it's received by Cloudflare, passed to our Google Firebase service and sent on to your inbox by Amazon Web Services (Amazon SES). It exists only in computer memory while this happens and is never saved by us. If your inbox is temporarily unavailable, Amazon SES may hold the email for a short time while retrying, then discards it. These providers keep basic delivery records (for example, that an email was delivered at a certain time), but we don't keep the email's content.

Private addresses are for websites and businesses. Email from personal mailbox services (such as Gmail or Outlook), and email that fails standard sender checks, is refused. To cut down on advertising, each private address passes on at most 3 adverts a day from any one company; account emails such as password resets, codes and receipts aren't limited this way. To tell them apart, our service reads the email's subject and technical headers while passing it on. It doesn't store them. It keeps a daily count per company and private address (the company's domain is scrambled), deleted the next day.

Fair use: private email is for normal personal use. To prevent abuse, if an unusually large number of emails is sent to one person's private addresses in a calendar month (more than 2,000), adverts are paused until the next month, and above 3,000, passing emails on is paused until the next month. Each person can have up to 50 private addresses at a time. The app tells you if a limit is reached. For this we keep a count of emails passed on for you in the current month.

If you reply to a passed-on email from your normal inbox, the sender will see your real email address.

6a. Safety contacts (optional)

You can choose friends or family members (five people in total, ever) to get an email if a big change is made in the app, for example many passwords deleted, a family key used, or a big change asked for. If you do, we keep:

• your first name as you typed it, so they know who the email is about;
• each contact's name, and their email address encrypted;
• whether they've agreed to be a contact, and the times alerts were sent (to limit how many).

Each contact first gets one email asking whether they agree. They only get alerts after they say yes, and every email has a link to stop them. The emails are written by us from fixed wording and never contain passwords. They are sent by Amazon Web Services (Amazon SES).

Please only add people who would expect to hear from you this way.

6b. Protections against mistakes and pressure

Deleted passwords are kept, encrypted on your phone, for 30 days so they can be brought back, and each login keeps its last five passwords. Big changes, such as turning off the cloud backup, a new recovery key, removing a family member or safety contact, automatic deletion and "Delete all my passwords", wait 7 days and can be cancelled. New family keys start working after 7 days. All of this happens on your phone; only the safety contact emails above involve our server.

7. Ratings

After a few days of use, the app may ask whether you'd like to rate it, using Google Play's in-app review. Google handles your rating under its own policy; we only see the public review, as on any Play Store page.

8. Technical information

Like any internet service, our providers (Google Firebase and Google Cloud, Cloudflare and Amazon Web Services) briefly record technical details of requests to our server, such as the time, the IP address and whether it succeeded, to keep the service running and secure. We don't use these records to identify you or follow what you do, and our server code never logs backups, receipt codes, email addresses or email content.

To stop people misusing the service, for example by creating many private email or safety contact accounts, or sending many confirmation codes, our server keeps a daily count of these requests per internet address. The address is stored only in scrambled (hashed) form, and the counts are deleted the next day.

The app uses only these Android permissions: internet and network status (for backups, purchase checks, private email and safety contacts), fingerprint / face unlock, and Google Play billing (for purchases). It doesn't ask for your contacts, location, camera, microphone, photos or files.

9. Summary of what we keep

Because cloud backups aren't linked to any account, we can't tell when someone has stopped using the app. We automatically delete a backup that hasn't been updated for 2 years. Opening the app at least once a month keeps it up to date.

10. Deleting your information

Step-by-step instructions, including what to do if you no longer have the app, are on our Delete your data page.

• Settings → Cloud backup: OFF deletes your cloud backup copies.
• "Delete all my passwords" deletes everything on your phone, your cloud backup copies, your safety contacts and your private email account, 7 days after you ask (it can be cancelled until then).
• The automatic deletion option (if the app isn't opened for a time you choose) deletes everything on your phone and your cloud backup copies. A private email account can't be removed this way while the app is locked; its addresses stop working when Premium ends, or you can contact us.
• Deleting a private address removes it from our systems straight away.
• A safety contact can stop the emails at any time with the link in each email, which removes them from the alert list.
• Uninstalling the app deletes everything on your phone. To also remove your cloud backup or private email account, delete them in the app first. Because cloud backups aren't linked to your name, email or account, we can't find one for you afterwards; it will be removed once it goes unused (section 9).

Copies you made yourself (Google account backup, a Google Drive file) are managed in those services.

11. Security

Besides the encryption described above, all communication with our server uses HTTPS, our database can't be read directly from the internet, and secret keys used by our server are kept in Google Cloud Secret Manager. No system is perfectly secure, but because your passwords are encrypted on your phone with keys we never have, a break-in at our end wouldn't reveal them.

12. Who we share information with

We don't sell, rent or trade your information, and we don't share it for advertising. We use these service providers only to run Safe Keeping:

• Google (Firebase, Google Cloud, Google Play): server, database, website, purchases (Google's privacy policy);
• Cloudflare (Email Routing and Workers): receiving emails for private addresses, checking that senders are genuine, and turning away junk and personal email before it reaches our server (Cloudflare's privacy policy);
• Amazon Web Services (Amazon SES): sending emails on to you, confirmation codes, and safety contact emails (Amazon's privacy policy).

Our server runs in the United States. We may disclose information if the law requires it, but we can only hand over what we have, and that never includes your passwords in readable form.

13. Your rights

Depending on where you live (for example under the GDPR in the UK and EU, or California's CCPA), you may have the right to access, correct, delete or move the personal information we hold about you, to object to or limit its use, and to complain to your data protection authority. Most of it can be deleted directly in the app (section 10). For anything else, contact us using the details below. We won't treat you differently for using these rights.

Where the GDPR applies, we rely on providing the service you asked for (backups, purchases, private email) and our legitimate interest in keeping it secure and preventing fraud.

14. Children

Safe Keeping isn't directed at children under 13 (or the minimum age in your country), and we don't knowingly collect their information.

15. Changes to this policy

If we change this policy, we'll update the date at the top and, for important changes, tell you in the app or on the Play Store listing before they take effect.

16. Contact

Questions or requests: [support@safekeepingvault.app]
[Pixel Perfect Studios]
[Business address]

Before publishing: fill in the bracketed parts and have this reviewed for your country. It describes how the app works but isn't legal advice.