Private Vault — Privacy Policy
Effective date: November 12, 2026
This Privacy Policy applies to Private Vault, provided by MFG Platform (“we”, “us”, or “our”). Privacy contact: mfgplatform@gmail.com.
1. How this version works
This release is a local-first web app/PWA. It does not create a cloud account, provide cross-device synchronization, or upload vault files to an MFG Platform file server. An account created in this release exists only in the browser storage for this website on the device where it was created. The same email address on another device is a separate local account unless a future version clearly introduces a disclosed sync service.
2. Information stored locally on your device
- Account identifier: the email address you enter, stored locally to identify your vault on this browser.
- Password verification data: a random salt and an encrypted verification value derived from your account password. The app does not save the raw account password.
- App Lock data: if enabled, a random salt and encrypted verifier for your separate App Lock password/PIN.
- Remember Login data: a non-extractable, password-derived cryptographic key stored in IndexedDB so the app can restore your session without saving your raw password. App Lock, when enabled, is still requested on return.
- Vault content: photos, videos, and PDF files that you choose to add. File contents and file metadata (such as file name, type, size, and date added) are encrypted locally before being saved in IndexedDB.
Local browser storage is controlled by your device and browser. Clearing website/app storage, uninstalling or resetting the browser, changing browser profiles, or device failure may make the vault data unavailable. Keep independent backups of important files. Files you export or download from the Vault are outside the app's encrypted storage and are handled by the destination app or folder.
3. How we use information
The app uses the locally stored information only to create and unlock your local vault, encrypt/decrypt your selected files, display your file list, remember your session, and apply the optional App Lock. The app does not send vault file contents, account passwords, App Lock PINs, or local account records to MFG Platform servers.
4. Hosting provider and network information
The static app website is hosted using Cloudflare Pages. When your browser requests the app website and its static files, Cloudflare may process technical connection and security metadata such as IP addresses, request URLs, browser/device configuration, and traffic information to deliver, secure, and maintain its services. This hosting-provider processing is governed by Cloudflare's own terms and privacy policy: Cloudflare Privacy Policy. The app's vault features do not upload your selected files, account password, or App Lock PIN to Cloudflare.
5. Sharing and third-party services
This app version does not include advertising SDKs or analytics SDKs and does not sell personal information. It does not share locally stored vault files with other app users. If you choose to open an external support or social link, that third-party service may receive information according to its own privacy policy. We do not control third-party services.
6. Security
File contents and metadata are encrypted locally using AES-GCM with a 256-bit key derived from your account password using PBKDF2-SHA-256. HTTPS protects the connection used to load the hosted app. The optional 4-digit or 6-digit App Lock PIN is an additional in-app access barrier; it is not the file-encryption key and is not equivalent to Android hardware-backed authentication. No software can guarantee absolute security. A compromised, rooted, shared, or unlocked device, malicious browser extension, malicious software, or someone who knows your credentials may expose information. Keep your device screen lock enabled and do not share your password or PIN.
7. Retention and deletion
Your local account and vault files remain in this browser's storage until you delete them. You can delete individual files, delete all files, or use Settings → Delete Account & All Local Data inside the app. Account deletion removes that local account, its encrypted files, App Lock settings, and remembered session from the current browser storage. There is no MFG cloud copy of this local vault for us to delete. Exported copies and backups must be deleted separately by you. If you cannot access the app, follow the steps on our Account and Data Deletion page or contact mfgplatform@gmail.com for assistance.
8. Children's privacy and intended audience
The publisher must select the correct target audience and complete any applicable Google Play Families and child-safety requirements before distribution. Do not submit this app as child-directed unless the app, its SDKs, disclosures, and data practices have been reviewed for the applicable requirements.
9. Changes to this policy
We may update this policy when app functionality, hosting, or data practices change. The effective date above will be updated when a revised policy is published. The Play Store Data safety disclosures must also be updated to match the released app.
10. Contact
For privacy questions or help with local data deletion, contact mfgplatform@gmail.com. App/service: Private Vault. Publisher: MFG Platform.