Privacy.

The short version

VaultPony has no server, no account, no telemetry, no analytics, and no advertising. Your vaults are files on your own device. There is nothing to collect, nowhere to send it, and no code in the app capable of sending it.

What the app collects

Nothing. This is stronger than a policy commitment: the Android manifest does not declare the INTERNET permission, and the Rust core links no networking libraries, which is enforced by the dependency policy in CI rather than left to good intentions. Even if the app wanted to phone home, the operating system would not let it.

There are no analytics SDKs, no advertising SDKs, and no third-party crash reporters. We do not know who uses VaultPony, how often, or what is inside your vaults, because none of that ever leaves your device.

What stays on your device

• Your vaults are ordinary files, wherever you chose to put them. VaultPony does not move, copy, or index them.
• A list of vaults you have opened, so they are easy to find again. This is exactly what no-trace mode turns off; with it on, the app keeps no record of which vaults exist or where.
• Unlock parameters such as the cipher and hash a vault used, cached so the next unlock is faster. These contain no secrets and no evidence that a hidden slot was ever probed.
• An optional stored password, only if you switch on biometric unlock, held behind the device's biometric hardware. This is off by default, and the app never offers it for a hidden volume.
• An optional stored PIM, opt-in for each vault separately, because a stored PIM is weak evidence that a vault has a non-default configuration.

Passwords, derived keys, and decrypted data live in memory only and are wiped when a vault locks.

Permissions the app requests

One, and it is optional. USE_BIOMETRIC backs the biometric unlock you have to turn on yourself. That is the entire list. There is no internet permission and no storage permission: files are reached through Android's Storage Access Framework, so the app only ever sees the specific files you hand it.

The website

This site sets no cookies and runs no analytics or trackers. Fonts are self-hosted, so no third-party font service sees your visit. There is no CDN in front of the site. There is no contact form, no newsletter, and no waitlist. Your visit is not profiled.

If you switch the site between light and dark, that choice is stored in your own browser and never sent anywhere.

Downloads and distribution

The APK is served from GitHub Releases, so downloading it is a request to GitHub and is covered by GitHub's own privacy policy. VaultPony receives nothing from it. The same will be true of F-Droid, the App Store, and Google Play as those channels open: each is governed by its own terms, and none of them report anything back here.

Third-party services

The app uses none. The website uses none. That is the entire list.

Children's privacy

VaultPony is for general audiences. The app collects no data from anyone, including children. There are no in-app purchases, no advertising, and no user-generated content.

Changes to this policy

If this policy changes materially, the "Last updated" date above will change with it.

Contact

Questions about privacy or this policy: NorseHorse@norsehor.se.