Privacy Policy
Last updated: June 11, 2026
1. Introduction
Fadelock ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use the Fadelock mobile application and website (collectively, the "Service").
2. Zero-Knowledge, Local-Only Architecture
Fadelock is built on a zero-knowledge, local-only architecture. This means:
- We never see, store, or transmit your generated passwords.
- Your encryption key is derived locally on your device and never leaves it.
- Vault credentials are encrypted with AES-256 and stored exclusively on your device.
- Your vault data is never uploaded to our servers or any cloud service.
- We cannot access, decrypt, or recover your vault data under any circumstances.
3. Information We Collect
3.1 Account Information
When you register, we collect your phone number solely for verification purposes. We do not store your phone number after verification is complete.
3.2 Subscription Data
If you subscribe to a paid plan, payment processing is handled entirely by Apple (App Store) or Google (Google Play). We receive a subscription status confirmation but never see your payment details.
3.3 Analytics (Optional)
We collect anonymous, aggregated usage analytics (e.g., feature usage frequency, crash reports) to improve the app. This data cannot be tied to individual users or their passwords. You can opt out in Settings.
3.4 Advertising
Free-tier users may see ads served by Google AdMob. AdMob may collect device identifiers for ad personalization. You can opt out of personalized ads in your device settings. Paid users and those who purchase "Remove Ads" see no advertisements.
4. How We Use Your Information
- To verify your identity during registration.
- To verify subscriptions and process in-app purchases.
- To send push notifications (breach alerts, expiry reminders) if enabled.
- To improve app performance and fix bugs via anonymous analytics.
5. Data Storage and Security
All sensitive data (passwords, credentials, encryption keys) is stored exclusively on your device using platform-native secure storage (iOS Keychain / Android Keystore). Nothing is ever uploaded to our servers. To move your vault between devices, you create an encrypted backup file that you control. The only data that ever leaves your device is a short scrambled hash fragment used for privacy-preserving breach checks — never your actual passwords.
6. Breach Monitoring
Fadelock uses the Have I Been Pwned API with k-anonymity to check passwords against known breaches. Only the first 5 characters of a SHA-1 hash prefix are sent — your actual passwords are never transmitted, even in hashed form.
7. Third-Party Services
- Twilio — Phone number verification (SMS delivery only).
- Google AdMob — Advertising for free-tier users.
- Firebase Analytics — Anonymous usage analytics.
- Have I Been Pwned — Breach monitoring via k-anonymity.
- Apple/Google — In-app purchase and subscription management.
8. Data Retention
Because your vault is stored only on your device, deleting the app removes all your data. Any minimal account-related verification data is permanently erased within 30 days.
9. Children's Privacy
Fadelock is not intended for children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately.
10. Your Rights
You have the right to:
- Access the data we hold about you.
- Request deletion of your account and associated data.
- Opt out of analytics and personalized advertising.
- Export your vault as an encrypted backup file at any time (paid users).
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via in-app notification or email. Continued use of the Service after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy, contact us at: