Privacy Policy · Password Vault Pro

CloudEx Inc. ("we", "us", or "our") operates the "Password Vault Pro" app (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices available to you. By using the Service, you are deemed to have agreed to the practices described in this Policy.

1. Our Core Principle

Password Vault Pro is a password manager. It stores your usernames, passwords, and other items encrypted on your own device, and fills them into sign-in screens through Android's autofill service. There is no account and no sign-up, and we do not operate any server that receives the contents of your vault. We cannot see, collect, or recover the items you save. Specifically, we do not have access to any of the following:

Your master password
The items in your vault: usernames, passwords, websites, cards, bank accounts, Wi-Fi passwords, identities, licenses, notes, custom fields, and two-factor (2FA) keys
Which apps and websites you sign in to
Your backup files and your password history

The contents of your vault leave your device only through actions you take yourself, such as exporting a backup or a CSV file (Section 3.2), or through Android's own backup if you have turned it on.

2. How Your Vault Is Protected

Encryption: Your vault is encrypted with AES-256-GCM. The key that opens it is derived from your master password with PBKDF2-HMAC-SHA256, using an iteration count measured on your device (at least 100,000). Your master password itself is never stored or sent anywhere.
Fingerprint and face unlock: If you turn this on, a copy of the vault key is protected by a key in the Android Keystore that can be used only after you authenticate. The app never receives your fingerprint or face data; Android handles the authentication.
Locking: The vault locks automatically after the time you choose and, by default, when the screen turns off. Repeated wrong master passwords add an increasing waiting time; your data is never erased because of wrong attempts.
Screen and clipboard: By default the app blocks screenshots and hides its content in the recent-apps screen. Passwords you copy are cleared from the clipboard after the time you choose, and on Android 13 and later they are marked as sensitive so they are not shown in the clipboard preview.
No recovery: Because we never have your master password or your vault, we cannot reset your master password or restore your data. Please keep your master password and a backup somewhere safe.

3. Information We Collect

3.1 Information Collected Automatically

Anonymous crash reports: Via Firebase Crashlytics. When the app crashes, we collect the stack trace, device model, OS version, and app version. This does not include personally identifiable information or the contents of your vault.
Purchase information: We use purchase tokens issued by Google Play to verify your one-time "Premium" purchase. We never receive any payment information such as credit card numbers.
List of our other apps: To show our other apps, the app downloads their names, descriptions, and icons from our content server (static files hosted on Cloudflare Pages). The request contains no personal data from the app. As with any request to a web server, the server receives your device's IP address as part of the connection. Tapping an app in the list opens its page on Google Play.

The app does not use any analytics service, and it does not collect or use your device's advertising ID.

3.2 Information Stored Only on Your Device

Your vault: The items you save, their folders and tags, password history (the last 10 passwords of each item), the trash (deleted items are kept for 30 days), and the history of passwords you generated (the last 30) are stored encrypted in the app's storage on your device.
Snapshots: So that you can go back to an earlier state, the app keeps one encrypted copy of your vault on your device for each day the vault changes (up to the latest 7; older ones are deleted automatically).
Backups you export: Backup files (.pvault) are encrypted with your master password and are written only to the place you choose. If you turn on automatic backup, the app saves an encrypted backup to the folder you choose (one per day with changes, the last 7).
CSV files: CSV files you export are not encrypted; anyone who can open the file can read your passwords. The app asks for your master password before exporting. Keep such files safe and delete them after use. When you import a CSV file, the app offers to delete the original file afterwards.
App settings: Settings such as the auto-lock time, the theme, and the list of apps you chose not to autofill are stored on your device.
Android backup: If backup is turned on in your device settings, Android may include the encrypted vault and the app's settings in the backup it saves to your own Google account, and may copy them to a new phone when you transfer your data. The vault stays encrypted with your master password. The fingerprint key and the snapshots are always excluded. This is handled by Android; we have no access to it.
When you uninstall: Uninstalling the app or clearing its data deletes the vault, snapshots, and settings stored in the app's storage. Backup and CSV files you exported remain where you saved them until you delete them.

3.3 Autofill

When you choose Password Vault Pro as your autofill service, Android shows the app the structure of the sign-in screen you are using — the types of the input fields, the package name of the app, and, in supported browsers, the domain of the website — so that it can suggest matching items. This is processed on your device only and is never recorded or sent anywhere. The app fills in only the item you select. When it offers to save a new sign-in, the username and password are saved to your vault only if you accept.

3.4 Leak Check (Have I Been Pwned)

Only when you tap "Check for leaked passwords", the app checks your passwords against known data breaches using the Have I Been Pwned "Pwned Passwords" service (api.pwnedpasswords.com, operated by Troy Hunt and served through Cloudflare). For each password it sends only the first 5 characters of its SHA-1 hash, receives a list of hash suffixes that start with them (padded so that the response size does not reveal anything), and compares the results on your device. Your passwords and their full hashes are never sent. As with any web request, the service receives your device's IP address.

3.5 QR Codes

When you add a 2FA account by scanning a QR code, the scan is performed by the Google code scanner in Google Play services; the app itself does not request the camera permission and receives only the text of the QR code. When you read a QR code from a screenshot, the image you pick is decoded on your device with Google ML Kit. The app uses the result only to save the 2FA key you scanned.

3.6 Information We Explicitly Do Not Collect

Your master password or the contents of your vault
The apps and websites you use or sign in to
Your name, email address, phone number, or contacts (the app has no account or sign-up)
The contents of your screen or of other apps, other than the sign-in fields Android passes to the autofill service as described above
Your location, photos, or files, other than the files you choose to import or export
Icons of the websites you save (the app does not download them, so the sites you use are not revealed)

3.7 Permissions the App Requests and Their Purposes

Internet (INTERNET) and network state (ACCESS_NETWORK_STATE) — Used only for the leak check you start yourself, anonymous crash reports, Google Play purchase verification, in-app reviews and in-app updates, downloading the list of our other apps, and showing this privacy policy in the app. Saving, autofill, the generator, and 2FA codes work without an internet connection.
Biometrics (USE_BIOMETRIC / USE_FINGERPRINT) — Unlocks the vault with your fingerprint or face if you turn this on.
Google Play Billing (com.android.vending.BILLING) — The one-time Premium purchase.
Autofill service (BIND_AUTOFILL_SERVICE) — Lets Android connect the app as your autofill service. It works only after you select Password Vault Pro in your device's autofill settings.
Quick Settings tile (BIND_QUICK_SETTINGS_TILE) — The optional "New password" tile, which creates a password and copies it to the clipboard.

The app does not request access to your camera, location, contacts, photos, or notifications.

4. How We Use Information

The limited information we collect is used only for the following purposes:

Operating and maintaining the Service
Verifying your Premium purchase
Diagnosing and fixing crashes
Responding to support inquiries
Complying with applicable laws

5. Third-Party Services

Password Vault Pro uses the following third-party services. Each service has its own privacy policy.

Firebase Crashlytics (Google LLC) — anonymous crash diagnostic data
Google Play Billing (Google LLC) — the one-time Premium purchase; payment is completed on Google Play, and we receive only a purchase token
Google Play In-App Review and In-App Updates (Google LLC) — let you rate the app and install updates without leaving it; handled by Google Play
Google code scanner and ML Kit (Google LLC) — reading QR codes for 2FA, as described in Section 3.5
Have I Been Pwned – Pwned Passwords (Troy Hunt, served through Cloudflare, Inc.) — the leak check you start yourself, as described in Section 3.4
Cloudflare Pages (Cloudflare, Inc.) — hosts the static list of our other apps

We do not sell your data, and we do not share it with advertising networks.

6. Data Retention

Crash reports: retained for 90 days, then deleted.
Your vault and settings on your device: kept until you delete them, delete the vault, uninstall the app, or clear the app's data. Items in the trash are deleted automatically after 30 days. Only the latest 7 snapshots are kept, and older ones are deleted automatically.

7. International Data Transfers

We are based in Japan. The infrastructure used for crash diagnostics, the leak check, and hosting the list of our other apps may be located in various countries. When you use the Service, the minimal information described above may be processed outside your country of residence under standard contractual safeguards.

8. Your Rights

Depending on where you reside (e.g., the EEA, UK, California, Japan), you may have the right to request access to, correction of, or deletion of the limited information we hold. You can:

Edit or delete items in the app at any time, or delete the whole vault from "Backup and export"
Export your data as an encrypted backup or a CSV file and take it to another app
Uninstall the app or clear its data to erase the vault, snapshots, and settings stored on your device
Choose another autofill service in your device settings at any time
Contact us at the address below to make a request regarding the information we hold

9. Children's Privacy

Password Vault Pro is not directed to children under the age of 13 (or the minimum age applicable in your region). If we inadvertently collect information from such a child, we will delete it promptly upon being contacted.

10. Changes to This Policy

This Privacy Policy may be updated from time to time. The latest version is always published at this URL together with its effective date. We will also notify you within the app of significant changes as appropriate.

11. Contact

For questions about privacy, data requests, or to report concerns, please email us at .

CloudEx Inc. (Japan)

Effective Date: November 7, 2026