Privacy Policy

Last updated: 2026-09-23

Lockwell ("the App") is a KeePass-compatible password manager. Your vault data stays on your device or storage you choose.

Shown in-app under Settings → About → Privacy Policy.

Support: yogendra.danwar@gmail.com

Data we collect

The App does not collect personal data on our servers. There is no Lockwell account and no first-party analytics.

Data stored on your device

• Password vault files (.kdbx) and entries you create or import.
• An optional app unlock PIN and biometric preference.
• App preferences (theme, clipboard timer, etc.).
• App purchase status via Apple/Google (paid download; handled by the store; we do not receive payment card details).
• Optional tip purchases via Apple In-App Purchase / Google Play Billing (consumable; unlock no features).

Vault credentials and master passwords are stored encrypted in KeePass format. The app unlock PIN is stored in iOS Keychain / Android Keystore.

Network

The App works offline by default. Network is used only when you enable optional features:

• Have I Been Pwned (optional): when you enable breach checks and run a scan, Lockwell sends only the first five characters of a SHA-1 password hash to the Have I Been Pwned range API (k-anonymity). Your full password never leaves the device.
• Vault import from URL (optional): connects only to the HTTPS address you enter, to download a .kdbx onto this device. The link is not sent to Lockwell.
• Google Drive (optional): see Google user data below.
• Dropbox (optional): when you choose Dropbox and sign in, Lockwell uses Dropbox OAuth so you can browse folders, open a .kdbx, create a vault in a folder you choose, and write your edits back to that same Dropbox file when you save. Access tokens stay in the device Keychain/Keystore. You can disconnect anytime in the Dropbox browser. You can also open Dropbox via the system Files picker (local copy only; no write-back unless you sign in).
• iCloud (optional): on iOS you can open or place vaults via Files → iCloud Drive (local working copy on device).
• Favicon fetch (optional): requests icons from URLs derived from your entry websites.
• Store payments: Apple / Google process the paid app purchase and any tip payments; Lockwell does not receive card details.

Lockwell does not upload your vault to our servers.

Google user data

This section applies when you optionally sign in to Google Drive inside Lockwell (Android / iOS). Signing in is never required to use Lockwell with local vaults.

What Google user data is accessed

When you tap Sign in with Google for Drive, Lockwell requests OAuth access to:

• Google account identity (email, basic profile) via openid, email, and profile — to identify your Google session and show which account is connected.
• Google Drive per-file create / write-back via https://www.googleapis.com/auth/drive.file — to create .kdbx vaults in the app-created Lockwell folder, list and open those vaults, and upload saves back to the same file.

Lockwell does not request full Drive access (auth/drive), drive.readonly, Gmail, Contacts, Calendar, Photos, or other non-Drive Google products. drive.file is used only for vaults in the Lockwell folder that this app created.

Typical Google user data processed on-device: Drive file ids/names for vaults you manage with Lockwell, file content of those .kdbx vaults (encrypted KeePass databases), and OAuth access/refresh tokens.

How Google user data is used

Lockwell uses Google user data only to provide Drive features you choose:

1. List KeePass vaults in the Lockwell folder this app created on Drive.
2. Create a KeePass vault in that Lockwell folder.
3. Open / download that .kdbx onto this device.
4. Save / sync (write-back): when you edit entries and save, Lockwell uploads the updated encrypted vault bytes to the same Drive file id.
5. Conflict checks: optional metadata (modified time / checksum) for that same file so Lockwell can warn if Drive changed elsewhere.

Google user data is not used for advertising, analytics, credit scoring, or training AI/ML models. Lockwell does not use Google Workspace APIs for AI features.

Sharing, transfer, and disclosure of Google user data

• Lockwell has no first-party backend that receives your Google Drive vault contents or OAuth tokens.
• Vault bytes and tokens stay on your device except when sent directly to Google’s Drive API over HTTPS to perform the create / download / upload you initiated.
• We do not sell Google user data.
• We do not share, transfer, or disclose Google user data to other third parties, affiliates, or data brokers.
• Disclosure may occur only if required by law (e.g. valid legal process); we have no cloud copy of your vaults to produce beyond what remains solely on your device / your Google account.

Data protection for sensitive data

• Encryption at rest: vault credentials remain inside KeePass .kdbx (user-controlled master password / key file). App unlock PIN uses iOS Keychain / Android Keystore.
• Encryption in transit: all Google API calls use HTTPS/TLS.
• Token storage: Google OAuth tokens are stored in the device Keychain (iOS) or Keystore-backed secure storage (Android).
• Purpose limitation: drive.file for create, open, and write-back of vaults in the Lockwell folder — not drive.readonly and not full auth/drive.
• User control: Disconnect Google in the Drive browser clears the local session/tokens. Uninstalling removes local vaults, PIN, and preferences (subject to platform backup). You can also revoke Lockwell in your Google Account → Third-party access.
• Limited Use: Lockwell’s use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

Third parties

Lockwell is an independent product and is not affiliated with Apple, Google, or KeePass. All trademarks belong to their respective owners.

Contact

Questions about this policy: yogendra.danwar@gmail.com

Deletion

Uninstalling the App removes locally stored vaults, PIN, and preferences from the device (subject to platform backup behavior). To remove Drive files Lockwell created, delete them in Google Drive or revoke app access as above.