Privacy Policy
GhostVault by Satrang Technologies. Last updated July 2026.
No data is collected
Not your name, email, location, device ID, or usage habits.
No accounts, ever
No sign-up, no login, no password recovery email.
GhostVault makes no network calls
Our own code never connects to any network. The only network-capable component is Google's Play Billing library, used for the one-time upgrade.
Your files never leave your device
Encrypted with AES-256-GCM and stored locally. That is the whole policy, really.
Data we collect
None. GhostVault does not collect, store, transmit, or have access to any personal data, file content, file names, usage statistics, device identifiers, or analytics of any kind.
GhostVault's own code makes zero network requests, and there is no GhostVault server. There is nothing for us to send your data to, even if the app wanted to.
We do not use Google Analytics, Firebase, Mixpanel, Crashlytics, Sentry, advertising SDKs, or any other third-party data collection tool. You can verify this yourself: open the app and go to Settings, Quality & Security Report, Privacy for a full technical breakdown.
Permissions we request
GhostVault requests the minimum permissions needed to function:
Photo and media access
Used only when you choose to import a photo, video, or document into your vault. The app never accesses your media in the background or without your explicit action.
Camera (optional)
Used only when you choose to capture a photo or video directly into the vault. Captures go straight into your encrypted vault and are never saved to your gallery or anywhere else; the temporary camera file is deleted after it is encrypted. The app never uses the camera in the background or without your explicit action.
Fingerprint / face unlock (optional)
If you enable biometric unlock, your device's biometric system is used to unlock the vault. Your fingerprint or face data is managed entirely by your device's operating system (Android's TrustZone or equivalent secure hardware). GhostVault never has access to this data directly.
Billing (Google Play)
The one-time Ghost and Panic PIN upgrade uses Google's Play Billing library, which is the only network-capable component in the app. It is used solely to process that purchase through Google Play. GhostVault's own code makes no network calls.
What we do not request
- Location
- Contacts
- Microphone
- Background activity or usage access
How your files are stored
Every file you add to GhostVault is encrypted individually using AES-256-GCM before being written to your device's storage. The encryption key is derived from your PIN using PBKDF2-SHA256 with 100,000 iterations, and exists only in memory while the vault is unlocked.
Your PIN is never stored in readable form. Only a one-way Argon2id hash is kept, which cannot be reversed to recover your PIN. If you enable biometric unlock, an encrypted copy of your Master PIN is stored in your device's secure storage (Android Keystore backed) so fingerprint or face unlock can work; it never leaves your device and is removed when you disable biometric unlock. This is why a forgotten Master PIN cannot be recovered: without the correct PIN, the data is unreadable, even to us.
File names are also encrypted and stored as unreadable data. Nothing about your vault's contents is visible by inspecting your device's file system.
On Android, automatic backups (including ADB backup and Google Drive backup) are disabled at the system level for this app, so your encrypted vault is never copied off the device.
Purchases
GhostVault offers one optional one-time in-app purchase, priced at $4.99, to unlock the Ghost PIN and Panic PIN features. This purchase is processed entirely by Google through the Play Store. There is no subscription.
GhostVault does not receive, store, or process any payment information: no card numbers, billing addresses, or names. We only receive a confirmation that a purchase was completed, which is stored locally on your device to unlock the relevant features.
Third-party services
GhostVault does not integrate with any third-party analytics services, libraries that phone home, or external APIs. The only external interaction is the Google Play purchase flow described above, which is handled entirely by Google's own systems under Google's privacy policy.
Children's privacy
GhostVault does not knowingly collect any information from anyone, including children under 13. Since the app collects no data from any user, this is true by design rather than by policy choice.
Changes to this policy
If this policy changes, the "Last updated" date at the top of this page will change accordingly. Given the app's offline architecture, we do not anticipate this policy changing often. There is not much to add to "we do not collect anything."
Contact
Questions about this policy or the app can be sent to support@satrangtech.com.
For security reports, contact security@satrangtech.com.
For a full technical breakdown of GhostVault's security architecture, open the app and go to Settings, Quality & Security Report.