Zero-Knowledge & Offline Security

Privacy Policy

Password Pal: Offline Vault is engineered strictly for offline privacy. Your data never leaves your device.

Application: Password Pal
Package ID: com.passwordpal.app
Last Updated: September 11, 2026
Contact: karamatsubhanipk@gmail.com
✓ Zero Data Collection: Password Pal does not collect, track, share, or monetize any user data. The app operates with zero network connectivity.

1 Overview & Core Philosophy

Password Pal is an offline password vault for Android designed with a zero-knowledge architecture. Our belief is fundamental: your passwords, notes, and credentials are completely private and belong solely to you.

The application requires no accounts, connects to no servers, and performs no cloud sync.

2 Zero Network Activity & Data Safety

In full alignment with Google Play Store Data Safety guidelines:

  • No Internet Permission: The release build does not declare android.permission.INTERNET or ACCESS_NETWORK_STATE. The application is technically incapable of establishing network connections or transmitting data.
  • No User Account: You are not required to provide an email, phone number, username, or login credentials to use the app.
  • No Third-Party SDKs or Trackers: Password Pal contains zero advertisements, zero analytics (e.g., Firebase, Google Analytics), and zero telemetry libraries.
  • Google Play Data Safety Declaration: We declare "No data collected" and "No data shared with third parties".

3 Local Encryption & Security Architecture

All stored passwords, accounts, and private notes exist strictly on your local device and are protected by modern cryptographic standards:

  • AES-256-GCM Encryption: Each vault entry is encrypted individually using authenticated AES-256-GCM encryption.
  • Argon2id Key Derivation: Master keys are derived using Argon2id (memory-hard key derivation) to safeguard against brute-force attacks.
  • Zero Knowledge: Your master password is never stored anywhere on disk or memory in clear text. There is no recovery backdoor; if you forget your master password, your vault cannot be recovered.
  • Screen Capture Protection: Android's FLAG_SECURE is activated so that other applications, recent app switchers, or malware cannot take screenshots or record your vault content.

4 Device Permissions

Password Pal requests only the minimum runtime permissions essential for on-device operation:

Biometric Authentication (USE_BIOMETRIC / USE_FINGERPRINT) Optional

Used solely to allow you to unlock your vault via fingerprint or face recognition. Authentication is handled entirely by Android's hardware security module (TEE / Secure Element). Password Pal never accesses or stores your biometric data.

Camera (android.permission.CAMERA) Optional

Used strictly if you choose to scan a QR code to import two-factor authentication (TOTP) codes. Camera frames are processed strictly in temporary device memory to decode the QR and are never saved, recorded, or transmitted.

5 Backups & Data Ownership

You have full and exclusive ownership over your vault data:

  • Manual Export: Encrypted backups and CSV exports are only generated when you explicitly request them, and are saved directly to the file destination you choose.
  • Cloud Backup Disabled: The app sets allowBackup="false" and applies explicit data extraction rules so your unencrypted vault is never copied to automated Google Drive backups.

6 Children's Privacy

Password Pal is not directed at children under the age of 13. Because the application does not collect any personal data whatsoever, we do not knowingly solicit or maintain data from children.

7 Changes to This Policy

We may periodically update this policy to reflect application enhancements or regulatory changes. Any updates will be reflected directly on this page with an updated "Last Updated" timestamp.

8 Contact Us

If you have any questions, inquiries, or security disclosures regarding Password Pal, please contact the developer at: