Last updated: August 4, 2026

This Privacy Policy applies to the Vaultly mobile application ("App") developed by Kybele Apps ("we", "us", "our"). By using Vaultly, you agree to the practices described in this policy.

1. Summary

Vaultly is a password manager that runs entirely on your device, with no server component.

• Your passwords, notes, and other vault data are stored only on your own device, in encrypted form.
• This data is never transmitted to us, our servers, or any third party.
• We cannot see your master password; no one but you can unlock your vault.
• The App does not include any third-party analytics or advertising tracking SDKs.

2. Information We Collect

2.1. Your Vault Data (passwords, usernames, notes, websites)

This data is stored locally only, in secure storage provided by your device's operating system (encrypted storage backed by Android Keystore / iOS Keychain). This data:

• Is encrypted using AES-256-GCM with a key derived from your master password via Argon2id.
• Is never transmitted to any server, because Vaultly has no server.
• Can only be accessed with your master password, your recovery key, or (if you have enabled it) your device's biometric authentication.

2.2. Your Master Password

Your master password itself is never stored in any form. Only a one-way hash is kept for verification purposes; it is not possible to reconstruct your original password from this hash.

2.3. Recovery Key

The recovery key shown to you once when you create your master password is not stored by the App — it is displayed on screen only. Storing it safely is your responsibility.

2.4. Biometric Data

Vaultly never sees, processes, or stores your fingerprint or facial data. Biometric authentication is handled entirely by your device's operating system; our app only receives a "success/failure" result.