[ ZERO-KNOWLEDGE COMMITMENT // AIR-GAPPED ]
CoVault Privacy Policy
Last updated: October 2026. This policy outlines how CoVault secures your sensitive credentials with strict 100% offline-first, zero-knowledge custody.
[ CORE HIGHLIGHT: ZERO SERVERS, ZERO SURVEILLANCE ]
CoVault is built from the ground up as a 100% offline-first application. Your vault items, passwords, seed phrases, notes, and attachments are encrypted and stored locally on your physical device. OriginFlowTech maintains no company servers to store your vault, has no master decryption keys, and never sells, tracks, or monetizes your data.
1. Information We DO NOT Collect
Because CoVault operates with zero remote server infrastructure, we do not collect, transmit, or retain:
• Master PINs or Passwords: Your Master PIN is used exclusively to derive local cryptographic keys and is never stored in plaintext or sent anywhere.
• Vault Contents: We cannot view, inspect, or reconstruct your bank records, credit cards, credentials, notes, recovery seeds, or document attachments.
• Biometric Data: Biometric authentication (Face ID, Touch ID, Fingerprint) is executed solely by your device's operating system (Apple Secure Enclave or Android Keystore). CoVault never has access to raw biometric vectors.
• Analytics or Behavioral Trackers: We do not include third-party tracking SDKs, ad networks, or user behavior tracking code in CoVault.
2. How Your Data is Stored Locally
All vault items and profile structures are stored directly on your physical hardware in an on-device SQLite database confined to CoVault’s sandboxed app directory.
Document attachments (images, PDF certificates, insurance cards) are saved within your device’s local filesystem documents directory under restricted app permissions.
3. Cryptography & Key Derivation
Whenever data leaves your device memory (during backup creation, export, or QR code sharing), CoVault applies military-grade cryptography:
• AES-256-CBC: Data is encrypted using the Advanced Encryption Standard with a 256-bit symmetric key in Cipher Block Chaining mode.
• PBKDF / SHA-256 Key Derivation: Keys are derived from your master PIN combined with a randomly generated 16-character cryptographic salt created for each individual export.
• Encrypted Attachments: File attachments are separately encrypted with AES-256 before being packaged into the .covault archive.
4. Peer-to-Peer QR Code Sharing
CoVault enables peer-to-peer credential transfer using encrypted QR codes. The payload is encrypted with AES-256 using a PIN established between the sender and receiver. The transfer is completely air-gapped and visual — no data is transmitted across the internet or cellular network during this process.
5. In-App Purchases (CoVault Pro)
Upgrades to CoVault Pro are processed exclusively by Apple App Store (In-App Purchase / StoreKit) or Google Play Billing. OriginFlowTech does not collect, receive, or store credit card numbers, billing addresses, or payment credentials. All transactions are governed by the respective store's privacy policy and terms.
6. Data Retention, Portability & Deletion
You maintain 100% control over your data lifecycle:
• Data Portability: You can export your entire vault or individual profiles at any time as an encrypted .covault archive or password-protected PDF.
• Profile Erasure: Deleting a profile inside CoVault permanently purges all associated items, fields, and filesystem attachments immediately.
• App Deletion: Uninstalling the CoVault application removes the local SQLite database and all cached attachment files completely from your device.
7. Compliance with Global Privacy Standards (GDPR & CCPA)
Under the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA):
• Right of Access & Portability: Fulfilled directly within the application via one-tap export.
• Right to Erasure ("Right to Be Forgotten"): Accomplished instantly upon profile reset or app uninstallation. Because we store no data on remote servers, no residual copies remain.
• No Sale of Personal Data: OriginFlowTech does not sell, trade, or monetize personal information.
8. Children's Privacy
CoVault is intended for adult users managing sensitive financial, digital, and legal credentials. We do not knowingly collect personal information from children under the age of 13.
9. Changes to This Privacy Policy
We may update this policy periodically to reflect enhancements in security architecture or relevant regulations. Any modifications will be posted to this page with an updated "Last updated" date.
10. Contact & Inquiries
If you have any questions regarding this Privacy Policy or CoVault's zero-knowledge security implementation, please reach out to us at:
support@OriginFlowTech.in