This app collects no data whatsoever.
It has no account system, no servers of its own, and no analytics. Your passwords are never uploaded: nothing in the app sends what you store, and there is no server for it to be sent to.
The app does request internet access, because Google Play's purchase system requires it. It is used for one thing — buying and restoring an optional upgrade through Google Play. See section 4.
This policy covers the Android application Lock Nest
(com.acesoftph.offlinepasswordwallet), distributed through Google
Play. In this document, “the app” means that application, and “you” means the
person using it on their own device.
None. Specifically, the app does not collect, transmit, sell, or share:
There is no server to send data to, and no code in the app that would do so. Buying an upgrade does not change this: the transaction is handled entirely by Google Play, and the developer receives no personal data from it — only anonymous sales totals in the Play Console.
Everything you save — entry titles, usernames, passwords, websites, comments, and any custom fields you add — is stored in a single encrypted file in the app's private storage area on your device. It is encrypted with AES-256-GCM under a key derived from your master password using PBKDF2-HMAC-SHA256.
Your master password and your five security-question answers are never stored, in any form, anywhere. Only cryptographic keys derived from them are used, and those keys exist only in memory while the vault is unlocked.
This data never leaves your device unless you personally choose to export it (see section 6). The developer has no access to it and no ability to read, recover, or reset it.
The app declares the INTERNET and ACCESS_NETWORK_STATE
permissions. They come from Google Play's billing library, which is required to
sell the optional capacity upgrades, and they are used for nothing else.
The app makes no network request of its own. There is no analytics, no crash reporting, no telemetry, no update check and no sync. The only component that can open a connection is Google Play's billing client, and it is reached only from the Upgrade screen — if you never open that screen, the app never connects to anything.
When you do buy or restore an upgrade, the purchase is carried out by Google Play, not by this app. Google receives the information it needs to process it — your Google account, your payment details and the product you bought — under Google's own privacy policy. This app never sees or stores your payment details, and nothing about your vault is included in a purchase. What the app keeps afterwards is a single value: which tier you are entitled to.
Your entries are never part of any of this. No password, title, username, custom field or search you type is transmitted, at any time, for any reason.
| Permission | Why |
|---|---|
INTERNETACCESS_NETWORK_STATE |
Required by Google Play's billing library so the optional one-time upgrades can be bought and restored. Used only for that. The app itself opens no connection, and no vault data is ever transmitted. Removing in-app purchases would remove both permissions. |
com.android.vending.BILLING |
Lets the app ask Google Play what you have purchased, so an upgrade you paid for is restored on a new phone or after a reinstall. |
USE_BIOMETRICUSE_FINGERPRINT |
To offer optional fingerprint or face unlock. Both are required by
Android's own BiometricPrompt component. Biometric matching is
performed entirely by the Android operating system; the app never receives,
sees, or stores your fingerprint or face data. This feature is off by
default and can be turned off at any time in Settings.
|
Choosing files for import and export uses Android's Storage Access Framework, which grants access only to the single file you pick, and therefore requires no storage permission.
The app can write two kinds of file, and only ever when you explicitly ask it to:
.opwbackup), protected by a
separate passphrase that you choose.
In both cases the file is written only to the location you select, the app keeps no copy, and nothing is uploaded anywhere. Once a file leaves the app, keeping it safe is up to you.
There are none. The app contains no advertising SDK, no analytics SDK, no crash-reporting SDK, and no tracking or fingerprinting code. No third-party service receives any information about you or your use of the app, because the app communicates with no third-party service.
Android's automatic cloud backup and device-to-device transfer are disabled for this app. Your encrypted vault is deliberately not copied to Google Drive or any other backup destination. If you want your data on another device, use the app's own encrypted backup export.
The app is a general-purpose utility, is not directed at children, and collects no data from anyone, including children under 13.
Because nothing is collected, there is nothing held about you to retain or delete. Your vault lives on your device for as long as you keep it. Uninstalling the app permanently deletes it, and because the data exists nowhere else, it cannot be recovered by you, by the developer, or by anyone else. Export an encrypted backup before uninstalling or changing phones.
Privacy laws such as the GDPR and the CCPA give you rights to access, correct, port, and delete personal data that a company holds about you, and to opt out of its sale. No personal data about you is collected, processed, stored, or sold by this app or its developer, so there is nothing held on our side for those rights to apply to. Your data is entirely in your own possession and under your own control at all times.
The app uses established cryptography and does not roll its own. It nevertheless cannot protect your data if your device itself is compromised, if malware runs with sufficient privileges, if you export a plaintext CSV and then expose it, if your master password is weak, or if someone guesses your security-question answers. No password manager can. The full security model and its limitations are documented in the project's README.
If this policy changes, the revised version will be published at this address with an updated effective date and a new entry in the table below.
| Version | Effective | What changed |
|---|---|---|
| 1.1.0 | 5 September 2026 |
In-app purchases added. The app now declares INTERNET,
ACCESS_NETWORK_STATE and com.android.vending.BILLING,
all from Google Play's billing library. Sections 4 and 5 were rewritten to
describe this. No change to how your vault is handled: it
is still stored only on your device, still never transmitted, and still
collected by no one.
|
| 1.0.0 | 31 August 2026 | First version. No in-app purchases and no network permission. |
Questions about this policy or about the app can be sent to walletp85@gmail.com, or raised publicly at the project's issue tracker. See also the support page.