Privacy Policy

We store the minimum needed to let you sign in and to hand your own encrypted key back to you. We cannot read your files. We cannot read your passphrase. We cannot unwrap your key. There is no analytics, no crash reporting, no advertising, and no third party we share anything with.

• Your provider identity: which provider you used (Google or Microsoft) and the immutable subject identifier that provider assigns you, plus a display copy of the name and email address that provider reports — shown back to you, and used for nothing else — and the times the identity was created and last used. We never store a token from your provider. The token your device obtains at sign-in is spent verifying who you are and then dropped.
• A keyed proof of your passphrase — not the passphrase, and not a plain hash of it. It lets us confirm you know your passphrase without ever seeing it.
• Your wrapped account key, together with the key-derivation salt and parameters. This is the encrypted form of the key that opens your vault. It is wrapped by a key derived from your passphrase, which we do not have, so we cannot open it. It is stored so you can move to a new device.
• An optional passphrase hint you may write yourself. It is stored as plain text and shown back to you. Do not put anything secret in it.
• Passkeys you register on the web: the credential's public key and the metadata WebAuthn needs (signature counter, authenticator identifier, transports, backup flags, a label you choose), plus that credential's own wrapped copy of your account key. Passkeys are a web feature and are not used by the Android or Windows apps.
• Whether you have locked your account, as a timestamp, so that only your passphrase can unlock it again.
• Your sessions and devices: a one-way hash of each session token — never the token itself — with the session type, a per-installation device identifier, a friendly platform label, the times it was created, last used and expires, so you can see and revoke your devices.
• Short-lived sign-up and sign-in state, which expires within minutes and is swept automatically.

No file, no note, no folder name, no file contents, no encryption key we can open, no passphrase, and no access or refresh token for any cloud account. Our database has no column for any of them, by design.

Files are encrypted on your device. What the encryption produces is ciphertext, and our servers never receive it.

If you choose to connect Google Drive, OneDrive or Dropbox on Windows or Android — a separate, optional step, never part of signing in — the encrypted files are uploaded to your own Drive, OneDrive or Dropbox, inside a vault folder Unlike Vault creates. Each one is stored as a separate object under a random identifier, in a flat folder with no hierarchy. Your file names, your folder names and your folder structure are uploaded only inside encrypted indexes— one for each device that writes to the vault — which your cloud provider cannot read. If you use Encrypted Notes, they are backed up the same way: encrypted, into the vault in each cloud you connect.

What your cloud provider can still see. The number of encrypted objects in that folder, how big each one is (and so, roughly, how big each file is), and when anything in it is written, renamed, deleted or downloaded. The number and size of the encrypted indexes show roughly how many devices have written to the vault and how many items it holds. Like any service you connect to, it also sees which account connects and from what IP address. Those are properties of the storage itself and we cannot hide them from the provider. Names are random and contents are ciphertext, but the shape of your activity is visible. One plain-text file sits alongside the objects recording only the product name, the vault format version, a random vault identifier and a creation date — no information about you or your files.

Unlike Vault requests only the narrowest cloud permission each provider offers: on Google Drive, a scope that can see only the files the app itself creates; on OneDrive, an app-folder scope; on Dropbox, the App folder access type, which confines the app to the one folder Dropbox creates for it. None of them grants any view of the rest of your storage.

Disconnecting. Disconnecting Google Drive revokes the permission at Google. Disconnecting Dropbox revokes it at Dropbox, refresh token included, so the connection is withdrawn in full. Disconnecting OneDrive cannot: Microsoft publishes no per-application revocation for an application of this kind, so Unlike Vault destroys its own copy of the token and tells you how to finish the job from your Microsoft account page.

To authenticate you, to return your own wrapped key to your devices, to let you see and revoke your sessions, and to enforce rate limits that protect your account. Nothing else.

Nobody. We do not sell, rent, or share your data with third parties. We run no analytics, no crash reporting, no advertising, and no advertising identifier. Your identity provider learns that this account signs in to Unlike Vault, and when — that is inherent to signing in with them, and happens at your direction. Your cloud provider stores the encrypted objects described above, in your own account, at your direction.

Your passphrase cannot be reset, by you or by us. If you lose it, your vault stays encrypted permanently. This is deliberate: a reset we could perform would be a door we could be compelled to open.

For as long as your account exists. Expired sessions and expired sign-up state are deleted automatically on a schedule.

When you delete your account, the rows go from the live database immediately.

Delete your account from within the app, or from unlikevault.com/delete-account/. Deleting the account removes every row we hold for you — identity, wrapped key, passkeys, sessions and devices — in a single cascading delete. It is immediate and irreversible.

Deleting your account does not delete the encrypted files in your own Google Drive, OneDrive or Dropbox, because they are yours and live in your storage, not ours. Delete the vault folder yourself if you want them gone. Without your passphrase they cannot be opened by anyone, including us.

Wherever you are, we honour access (a copy of what we hold about you — the list above is all of it), correction, erasure, portability and objection. In the EU and the UK, our lawful basis is performance of the contract — running the account you asked for. In India, requests under the Digital Personal Data Protection Act 2023, including a grievance about how we handled one, go to the same address.

All of it: dev@adamanture.com, which is also our grievance contact. A human reads it, usually within days rather than months.

Unlike Vault is for adults. You must be 18 or older to use it — that is a condition of the terms, not something the app checks. It is not directed to children, we do not advertise it to them, and we do not knowingly collect data from anyone under 18. If you believe a child has created an account, write to the address below and we will delete it.

All traffic is encrypted in transit. Files are encrypted with AES-256-GCM, and the key that wraps your account key is derived with Argon2id. On Windows and Android you may let the operating system's secure hardware hold your unlocked key behind Windows Hello or a fingerprint; the passphrase always still works.

We will update this page and change the date at the top. If a change is material, we will email you before it takes effect, and keep the previous version available. No silent edits.

dev@adamanture.com · Adamanture Private Limited.