Last updated 13 October 2026

Ringer Vault is a password manager for Android, with a companion browser extension. This policy describes what the app and extension do with your information. The short version: your vault is encrypted on your device, we never receive it, and the few things that ever go online are listed under "Network access" below.

What we collect

Nothing. Ringer Vault has no account with us, no servers of ours, no analytics, no crash reporting, and no advertising. We cannot see your passwords, your usage, or that you use the app at all.

What stays on your device

• Your vault. Entries are encrypted on the device with a key derived from your PIN or password. The key never leaves the device and cannot be recovered by anyone, including us.
• Settings and the security log. Stored on the device, encrypted where they relate to the vault.
• Biometrics. Fingerprint and face unlock are handled by Android. The app is told only whether the check succeeded; it never receives biometric data.
• Installed apps. When you use autofill or the sign-in sheet, the app checks which app is asking for a password and verifies its signing certificate, so a password is only offered to the app it belongs to. To do this it can see apps with a launcher icon and browsers, not every installed app. This check happens on the device and the list of your apps is never stored or sent anywhere.

Google Drive sync (optional, off by default)

If you turn on sync, Ringer Vault signs in to your Google account and stores one encrypted file in your Google Drive, in a hidden folder that only Ringer Vault can access (the drive.appdata permission). The file is encrypted on your device with a sync passphrase you choose, before it is uploaded. Google stores the file but cannot read it, and neither can we.

• Ringer Vault cannot see, read, or change any other file in your Google Drive.
• It does not access your contacts, email, profile, or any other Google data.
• The file goes directly between your devices and Google. It never passes through any server of ours.
• Google can see that the file exists, its size, and when it changes.

Ringer Vault's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this information to anyone, use it for advertising, or allow humans to read it.

Browser extension

The extension fills passwords into web pages, and offers to save the logins you type. A small script runs on the pages you visit. When you click into a login field it shows your saved logins for that site, drawn so the page cannot read them. It reads nothing you type until you send a form that has a password in it, and then passes only that username, password and page address to the extension itself, inside your browser. They go nowhere else, and are forgotten within a few minutes unless you choose to save them. Passwords are filled only into the page in front of you, when you choose an entry. The extension stores the encrypted vault in your browser and decrypts it only in memory while unlocked. If you connect Google Drive, it reads the synced file there, and writes to it only when you save a login, or when you fill an entry on a site it was not linked to and choose to have that site remembered, encrypted with your sync passphrase as the app does. While unlocked, its Settings show which Google account it syncs through, partly hidden until you click it; the address is read from Google and kept in memory only. If you pick a Google account other than the one Chrome is signed in to, that address is kept in your browser so Google can renew access without asking you again. Sites you mark "Never for this site" are remembered in your browser. It collects nothing.

Network access

Ringer Vault connects to the internet only in these cases, and never to a server of ours: