Safekeeping
Privacy Policy
Effective and last updated: November 9, 2026
This policy explains what information Safekeeping handles, why, and the choices you have. Safekeeping is made by P1x3l P3rf3ct Studios ("we", "us").
1. Your passwords
Everything you save in Safekeeping (website and app names, usernames, passwords, notes, two-step code setups and backup codes, photos you attach to logins, your recovery key and the names of family members you add) is stored inside the app on your phone, encrypted:
- Your information is encrypted with AES-256-GCM using a random key.
- That key is locked with your main password (strengthened with Argon2id), and separately with your recovery key and each family key.
- Your main password, recovery key and family keys are never sent to us or anyone else.
To set up a two-step code you can scan a QR code. Scanning is done on your phone by Google Play services' code scanner: Safekeeping does not get access to your camera or the picture, only the text in the code. If you email backup codes to yourself, your own email app sends them; they don't pass through us. Photos you add are shrunk on your phone (which removes hidden details such as location) and encrypted before they are saved.
2. Backups
Every backup is a locked copy. Nobody, including us, Google or our service providers, can open it without one of your keys.
Automatic cloud backup (on unless you switch it off)
After you make a change (and at least monthly), the app uploads a locked copy of your vault to our server (Google Firebase). This copy can be opened only with your recovery key or a family key, never with your main password. It is stored under a code worked out from your key, guarded by a scrambled (hashed) check value, and is not linked to your name, email address, phone number or Google account. We also keep the time it was last updated and a random code for your phone, so clearing out an old phone doesn't delete the backup a new phone is keeping up to date. Locked photos are kept with the backup.
Copies for a replaced recovery key or removed family member are deleted, as are all copies when you switch cloud backup off or use Delete all my passwords. A backup that isn't updated for 2 years is deleted automatically.
Android's backup to your Google account
Your phone can back up the app to your own Google account, only when Android can encrypt it end to end with your phone's screen lock. Google runs this backup; we don't receive it.
Backup file in Google Drive or another location (optional)
If you choose a location in Settings, the app saves the locked file there through Android's file picker. The storage app does the uploading; we don't receive the file.
Phone screen-lock recovery (optional, off by default)
If you turn this on, the key to your vault is stored with Google Play services (Block Store), end-to-end encrypted with your phone's PIN, pattern or password, so it can be restored on a new phone. We don't receive it. Anyone with both your Google account and your phone's screen lock could use it, which the app explains before you turn it on.
3. Fingerprint, face and autofill
Fingerprint and face unlock use Android's secure biometric system. Your fingerprint or face is checked by your phone and never reaches the app or us; the app only learns whether the check passed.
If you turn on autofill, Android shows Safekeeping the sign-in boxes on screen so it can offer the right password. This happens entirely on your phone, and nothing about the apps or websites you use is sent to us. Copied passwords are cleared from the clipboard after 30 seconds and marked as sensitive.
4. Purchases
Plus, Premium, Lifetime, family plans and the private email add-on are sold through Google Play. We don't receive your name, email address or payment details. To check that a purchase is genuine and hasn't been refunded, the app sends our server the purchase's Google Play receipt code (purchase token), the product bought and a random install code created by the app. We check these with Google and keep a scrambled (hashed) copy of the receipt code, the result of the check, the install codes that used it and Google's list of refunded or cancelled purchases.
Family plans. We also keep an encrypted copy of the plan's receipt code so we can check it is still paid for on behalf of the people you invite. Invite codes are stored only in scrambled form and expire after 7 days. For each member we keep a random ID, a scrambled sign-in code and the date they joined, with no names or email addresses. Removing someone, or leaving, deletes their record straight away.
5. Private email addresses (optional)
If you use private email addresses, we keep your real email address (encrypted) so we know where to pass emails on, the private addresses you've made, whether each is switched on, how many emails each has passed on, a reference to your purchase, and a short-lived confirmation code (scrambled, removed once used). Website names and notes you attach to each address stay on your phone.
When an email arrives for a private address, it is received by Cloudflare, passed to our Google Firebase service and sent on to your inbox by Amazon Web Services (Amazon SES). It exists only in memory while this happens and is never saved by us; Amazon SES may hold it briefly while retrying delivery. To filter out adverts, newsletters and personal mail, our service reads the email's subject and technical headers while passing it on, without storing them. We keep daily counts per sending company (scrambled) and a monthly count of emails passed on for you, to prevent abuse. If you reply to a passed-on email from your normal inbox, the sender will see your real address.
6. Safety contacts (optional)
You can choose up to five friends or family members to get an email if a big change is made in the app, such as many passwords deleted or a family key used. If you do, we keep your first name as you typed it, each contact's name and encrypted email address, whether they've agreed, and when alerts were sent. Each contact is first asked whether they agree, and every email has a link to stop them. These emails never contain passwords and are sent by Amazon SES.
7. Ratings
After a few days of use, the app may offer Google Play's in-app review. Google handles your rating under its own policy; we see only the public review.
8. Technical information
Like any internet service, our providers briefly record technical details of requests to our server, such as the time, IP address and whether it succeeded, to keep it running and secure. To prevent misuse, our server keeps daily counts of some requests per internet address in scrambled (hashed) form, deleted the next day. Our server code never logs backups, receipt codes, email addresses or email content.
The app uses only these Android permissions: internet and network status, fingerprint/face unlock, the autofill service (only if you turn it on) and Google Play billing. It doesn't ask for your contacts, location, camera, microphone, photos or files. The app has no ads, analytics or tracking.
9. Summary of what we keep
| Information | Why | How long |
|---|---|---|
| Locked cloud backup copies (only your keys open them) | Restoring your vault on a new phone | Until you switch cloud backup off, replace the key or delete everything; unused backups after 2 years |
| Scrambled receipt codes, install codes, check results | Confirming purchases, preventing refund abuse | While the purchase is active, then up to 12 months |
| Family plan receipt code, invite codes, member IDs and join dates | Sharing a family plan | Invites: up to 7 days. Members: until removed or they leave |
| Encrypted real email, private addresses, counts | Private email | Until you delete the address or account |
| Your first name, safety contacts' names and encrypted emails | Safety contact emails | Until the contact is removed, opts out, or everything is deleted |
| Email content | Passing emails on | Not kept: only in memory while forwarding |
| Providers' technical request records | Running and securing the service | Up to 30 days |
10. Deleting your information
- Settings › Cloud backup: OFF deletes your cloud backup copies.
- Delete all my passwords deletes everything on your phone, your cloud backups, safety contacts and private email account, 7 days after you ask (it can be cancelled until then).
- Deleting a private address removes it from our systems straight away.
- A safety contact can stop emails with the link in any email.
Full instructions, including what to do if you no longer have the app, are on our delete your data page.
12. Security
All communication with our server uses HTTPS, our database can't be read directly from the internet, and server secrets are kept in Google Cloud Secret Manager. Because your passwords are encrypted on your phone with keys we never have, a break-in at our end would not reveal them.
13. Your rights
Depending on where you live (for example under the GDPR in the EU and UK, or state laws such as the California Consumer Privacy Act), you may have the right to access, correct, delete or receive a copy of the personal information we hold about you, to object to or restrict how it is used, and to complain to your local data protection authority. Contact us to use any of these rights. We answer within 30 days and will not treat you differently for using them. We do not sell or share personal information for cross-context behavioral advertising.
Where the GDPR applies, we rely on providing the service you asked for (backups, purchases, private email) and our legitimate interest in keeping it secure and preventing fraud.
14. Children
Safekeeping is not directed at children under 13 (or the minimum age in your country), and we don't knowingly collect their information.
15. Changes to this policy
If we change this policy, we will update the date at the top of this page. For important changes we will also let you know in the app or on its Google Play listing before they take effect.
16. Contact us
Questions or requests about this policy or your data:
P1x3l P3rf3ct Studios
Safekeeping
[email protected]