Privacy Policy

Last updated: September 2026

What Lockbox stores on your device

All your vault data (passwords, secrets, notes, files, auth codes) is encrypted with AES-256-GCM using a key derived from your master password via PBKDF2-SHA256 (600,000 iterations). The encrypted database is stored locally on your device using expo-sqlite with per-item AES-256-GCM encryption.

Your master password is never stored anywhere. Not on your device, not on any server, not in any log.

What Lockbox sends to our server

Almost nothing, and never the contents of your vault in a form we can read. The app contacts our servers in three cases: the Whisper feature, cloud sync if you turn it on (see below), and a version check on launch. The version check sends only the app version, so we can warn you if a release needs replacing urgently; it carries no identifier and no vault data, and if it fails for any reason the app carries on normally. For Whisper:

• The encrypted ciphertext is uploaded to our relay server
• The decryption key is in the URL fragment and is never sent to our server (per RFC 3986)
• We cannot read your shared secrets
• Whispers are automatically deleted after first view or expiry

What the app does NOT collect

• No analytics or telemetry in the app or extension
• No usage tracking in the app or extension
• No crash reports containing personal data
• No advertising identifiers
• No location data
• No contacts or call logs
• No browsing history

This website

The Lockbox apps and browser extension contain no analytics. This website does: we run a self-hosted Umami instance to count page views, and to count how many people click through to the App Store, Google Play, the Chrome Web Store or our published encryption code. That second part records only which destination was clicked, so we can tell whether a download link is broken. It is cookie-less, records no personal data, does not track you across sites, and is never loaded on the Whisper page where a secret could appear in the URL. It tells us how many people visited and how many moved on, nothing about who they are.

Cloud sync (optional)

Cloud sync is off unless you turn it on. When enabled, your data is encrypted on your device before it is uploaded, and the encrypted blobs are stored on servers we operate. The encryption key is derived from your sync passphrase, which never leaves your devices, so we cannot read your synced data. We only ever hold opaque encrypted blobs.

To be precise about what our server can see: an anonymous account identifier derived from your passphrase, a per-device identifier, item identifiers, and the time each item last changed. It cannot see titles, usernames, passwords, notes, or any item contents.

Third-party services

Lockbox does not integrate with any third-party analytics, advertising, or tracking services. The only external service is the Whisper relay, which is operated by us on our own infrastructure.

Data deletion

Uninstall the app and all local data is gone. If you used cloud sync, open Settings and choose Delete cloud data to permanently remove your encrypted copy from our servers. If you used the Dead Man's Switch, the app automatically deletes all data after your configured inactivity period.

We also delete a synced vault that has not been reached by any of your devices for 12 months. Opening Lockbox on any device that syncs with it counts, whether or not you change anything, and resets the clock. Because syncing is what resets the clock, a vault can only reach that point if no device has opened Lockbox for a full year. Any sync at all, on any device, starts the year again. We keep no email address for you, so this is the only way we can avoid holding an encrypted copy that nobody uses and that you can no longer remove yourself. Your data on your own devices is never affected, and if a device still has the vault it simply uploads it again.

When you delete a synced vault we keep one small record of the deletion: the anonymous account identifier it used, and the date. It holds nothing derived from your vault, and we discard it after twelve months. It exists to protect you. Without it, another device of yours that was still paired would find an account that no longer exists, assume it had simply expired, and helpfully upload the whole vault again under the same identifier, which is exactly what you asked us to remove.

Cryptography you can verify

All encryption is done with proven, widely audited open-source libraries (@noble/ciphers and @noble/hashes) rather than hand-rolled cryptography. Our own encryption module is not yet published; when it is, it will be linked here. We would rather say that plainly than imply an inspection you cannot actually perform.

Contact

Questions about privacy? Email privacy@lockboxnow.app