Your privacy matters.

This Privacy Policy explains how GestureVault handles information when you use the app.

Vault information

GestureVault lets you store passwords, notes, photos, documents and secure records. The main vault stores this content in the app's local storage in encrypted form. GestureVault does not operate an account system or a cloud service that receives your vault contents.

Password breach checks

Password Health includes an optional breach check using the Have I Been Pwned Pwned Passwords service. This check only occurs when you choose to run it. GestureVault calculates the SHA-1 hash of the password on your device and sends only the first five characters of that hash to the Pwned Passwords service. Your full password and full password hash are not sent by GestureVault. The service returns possible matching hash suffixes and GestureVault performs the final comparison on your device.

Photos, camera and documents

You may choose photos, files or documents to add to your vault. GestureVault also uses the camera when you choose to scan a document. When a photo is copied into the vault, GestureVault can request access to your photo library so you can choose to remove the original copy from Photos. These permissions are used to provide the features you request.

Face ID

If you enable the Face ID app lock, GestureVault uses Apple's Local Authentication system to authenticate access. GestureVault does not receive or store your biometric data.

Apple Watch

If you use GestureVault with its Apple Watch app, TOTP information can be transferred between your paired iPhone and Apple Watch using Apple's WatchConnectivity framework. The Watch app caches transferred TOTP entries in its own Keychain so codes can remain available on the Watch. A full vault reset instructs the Watch app to clear that cached information.

Windows PC features

GestureVault can discover, pair with and communicate with a compatible Windows PC on your local network for gesture based sign in features. The app requests local network access for this purpose. Pairing and connection information used by these features is stored on the device.

Backups and exports

GestureVault lets you create vault backup files and restore them later. Portable backups can contain the encrypted vault data and an encrypted copy of the vault key protected using your recovery phrase. When you choose to export or save a backup, you control where that file is stored or shared. GestureVault can also export passwords to a CSV file when you explicitly choose that feature. Exported files may not have the same protection as information inside the vault, so you should store and share them carefully.

Decoy vault

GestureVault includes a separate decoy vault feature. Decoy notes are stored locally on the device. The decoy vault is separate from the encrypted main vault and is not intended to provide the same storage protection as the main vault.

Analytics, advertising and tracking

The reviewed GestureVault source does not include third party advertising, analytics or crash reporting SDKs. GestureVault does not use your vault information for advertising or cross app tracking.

Data retention and deletion

Vault information remains on your device until you delete individual content or reset the vault. Resetting GestureVault removes the app's vault files and GestureVault security material used by the vault, clears decoy notes and instructs the paired Watch app to clear cached TOTP information. Files that you previously exported, backups you saved outside the app, or copies that remain in other apps or locations are not deleted by resetting GestureVault.

Security

GestureVault is designed to protect locally stored vault information using encryption and device security features. No method of electronic storage or security can be guaranteed to be completely secure.

Children

GestureVault is a general purpose utility and is not designed to collect personal information from children. GestureVault does not operate an account service that knowingly collects personal information from children.

Changes to this policy

We may update this Privacy Policy when GestureVault changes. When we do, the effective date shown above will be updated.

Contact

Questions about this Privacy Policy can be sent to anythingspossibleerc@outlook.com.