Privacy Policy

Last updated: November 5, 2026

ShadowVault (“the app”) is a private vault and encrypted messenger for Android that looks and works like an everyday app (a calculator, weather, notes, clock, flashlight or compass app). It is published by Lennox Digital Labs LLC (“we”, “us”). This policy explains exactly what the app keeps on your phone, what reaches our servers, and what we can and cannot see.

The short version

• Your photos, videos, notes, files and contacts are encrypted on your phone. We never receive them and cannot read them.
• Chat messages and chat files are end-to-end encrypted. Our server only passes them along and cannot read them.
• No phone number, email address, real name or contact list is needed or collected. There are no ads, no analytics and no tracking tools.

Information kept only on your phone

• Vault content (photos, videos, notes, files, contacts, chat history): stored in an encrypted database and encrypted files, with keys protected by your secret code and your phone’s secure hardware.
• Break-in alerts (optional): after several wrong codes, a front-camera photo, the time and, if you already allowed location, your approximate location, sealed so that only your vault can open them.
• Disguise data: settings, the weather city you chose, and notes typed into the Notes disguise.

Information that reaches our servers

Our servers are run on Supabase (United States). We receive only what the features you use need:

• Chat account (only if you create one): a username you choose, a random account ID, public encryption keys, account creation time, and settings you choose (for example whether new accounts may send you requests). No phone number or email.
• Messages and files in transit: end-to-end encrypted envelopes, held only until your contact’s phone collects them. Encrypted chat files are deleted once delivered or within 30 days. Each envelope carries a cryptographic stamp that lets a recipient prove a message’s sender if they report it; the stamp reveals no content.
• Reports: if someone reports an account, we receive the reported account, the reason and, only if the reporter chooses to include them, that account’s recent messages to the reporter, which our server checks are genuine. Reports are reviewed by our staff to stop abuse.
• Encrypted backups (optional): your vault, encrypted on your phone with a key only your recovery phrase can unlock. We cannot open it, and we cannot recover it if you lose the phrase.
• Notifications and remote wipe (optional): a random device tag (stored only as a hash) and, if you set up remote wipe, a hash of your wipe code.
• Technical logs: like any online service, our hosting provider briefly records IP addresses and request times to run and protect the service.

The weather disguise searches for places on your phone and sends only the rounded coordinates of the place you pick to MET Norway (the Norwegian Meteorological Institute) to show forecasts; your secret code is never sent. Unlocking Premium with ShadowVPN uses an anonymous pass that contains no account, email or device identifier.

Permissions

• Camera: the private camera, QR codes, the flashlight disguise and (optional) break-in photos.
• Microphone: recording videos and voice messages.
• Photos and videos: importing items into the vault (and, if you choose, removing the originals).
• Approximate location (optional): only for break-in alerts. Never requested while someone else is using the disguise.
• Notifications (optional): disguised new-message alerts.
• Biometrics: fingerprint unlock. Fingerprint data is handled by Android and never accessible to the app.

What we never do

We do not sell or share personal data, show ads, use analytics or tracking SDKs, or scan your messages or files.

Keeping and deleting your data

• Uninstalling the app deletes everything stored on your phone.
• Chats → account button → Delete chat account deletes your account, keys and any messages waiting for you on our server, straight away.
• Settings → Encrypted backup → Delete backup deletes your backup from our server.
• Encrypted messages and files left undelivered are deleted after 30 days. Reports are kept while needed to review abuse.
• See how to delete your data for step-by-step help, or email us.

Security

The vault uses AES-256 (SQLCipher and AES-GCM) with Argon2id key derivation; chats use the Messaging Layer Security standard (MLS). No system is perfect, but the app is designed so that our servers never hold anything we could read.

Children

ShadowVault is not directed to children under 13, and we do not knowingly collect information from them.

Law enforcement

We respond to valid legal requests as the law requires. Because of the encryption, the only information we could provide is the limited account data described above; we have no access to vault content or messages.

Changes to this policy

If this policy changes, we will update this page and the date above.

Contact

Lennox Digital Labs LLC
Email: support@lennoxdigitallabs.com
Website: https://www.lennoxdigitallabs.com/apps/shadowvault/support/