Privacy Policy for HastVault

HastVault ("we", "our", or "us"), developed by HastRadar Consultancy Services Pvt. Ltd., is committed to protecting your privacy. This Privacy Policy explains our practices regarding the collection, use, and disclosure of information through our mobile application, HastVault (the "Application").

1. Zero Data Collection Principle

HastVault operates entirely on your physical device. Specifically:

• No User Accounts: We do not require registration, email addresses, phone numbers, or passwords.
• No Cloud Servers: HastVault does not operate cloud backend servers for storing user records.
• No Analytics or Trackers: We do not include third-party tracking libraries, advertising SDKs, or remote behavior loggers.
• No Internet Permission: The Application does not declare the android.permission.INTERNET permission in its manifest, making network transmission of data technically impossible from within the app.

2. On-Device Data Storage & Encryption

All information entered into the Application—including asset details, institutions, account or policy numbers, estimated valuations, notes, photos, and nominee records—is stored exclusively on your physical device.

• At-Rest Database Encryption: The local SQLite database is encrypted using SQLCipher (AES-256).
• Hardware Master Key: Cryptographic keys are generated and protected using the Android KeyStore system, backed by hardware-level security modules (TEE / Secure Enclave) where supported by your device.
• Application Lock: Access to the app is guarded by an optional 4-digit PIN (hashed with salted PBKDF2) and Android BiometricPrompt (Fingerprint / Face Unlock).
• Screen Protection: The Application enforces FLAG_SECURE to prevent unauthorized screenshots and recents-screen preview captures in the Android app switcher.

3. Permissions Requested and Their Purpose

HastVault only requests device permissions strictly necessary for local offline features:

1. android.permission.USE_BIOMETRIC & android.permission.USE_FINGERPRINT:
   Used solely to allow you to unlock your local vault using your device's fingerprint or biometric authentication. Biometric data is handled entirely by the Android OS and is never accessible to HastVault.
2. android.permission.RECORD_AUDIO:
   Used solely when you voluntarily tap the Voice Input microphone button to parse asset categories and amounts via on-device Android Speech Recognizer. Audio is processed on-device and is never recorded, saved, or uploaded.
3. android.permission.POST_NOTIFICATIONS:
   Used exclusively to send local, scheduled periodic review reminders on your device (e.g., quarterly or yearly check-in reminders via Android WorkManager).

4. Backups and User Portability

• You may choose to export an encrypted backup file (.hastvault) using the Android Storage Access Framework (SAF).
• Backups are encrypted with AES-GCM-256 using keys derived via PBKDF2 from your user password.
• The storage location (local disk, SD card, or personal cloud storage provider) is chosen entirely by you. HastVault has no access to your external backup destinations.

5. Compliance with India's DPDP Act, 2023 & Global Privacy Standards

HastVault adheres to the highest standards of Privacy by Design:

• Data Minimization: Zero unnecessary data processed.
• Purpose Limitation: All data processing is strictly local to provide personal record-keeping.
• Right to Erasure / Deletion: You retain absolute control over your data. You can delete individual records or permanently wipe all vault data and security credentials in one tap via Settings > Delete All Data. See our Data Deletion Guide for complete instructions.
• Child Privacy: HastVault does not solicit or collect data from anyone, including children under 18.

6. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. Any changes will be posted on this page and reflected with an updated date.

7. Contact Us

If you have any questions, feedback, or concerns regarding this Privacy Policy or HastVault, please contact us: