Photo Vault & App Lock: Kept — Privacy Policy

Effective date: 13 October 2026 · Applies to the Android app "Photo Vault & App Lock: Kept", shown as "Kept" on the phone (package com.kept.photovault), published on Google Play by Connection Lab Apps.

Kept is a photo vault and app lock that works entirely on your phone. We run no servers, you create no account, and nothing you keep in the vault is ever uploaded to us. This page explains, in plain language, what the app stores on your device, what it can send off the device, and why.

The short version:

Your photos, videos, audio, other files, thumbnails, and the vault database are encrypted on your phone and stay there.
We cannot read your vault, and we cannot recover it for you. Only your PIN (on the phone that created the vault), your fingerprint on that phone (or face unlock, where Android rates it as strong biometrics), or your recovery key can open it.
The only things that leave your phone are: Google Play subscription processing, ads in the free tier, anonymous usage statistics (which you can switch off in Settings), and crash reports. None of these include your files.

1. Data that stays on your phone

1.1 Vault content

Photos, videos, audio files, and any other files you add to Kept are encrypted with AES-256-GCM (Google Tink streaming encryption, per-file subkeys) and written to the app's private storage, which other apps cannot read. Thumbnails, including the cover art of audio files, are encrypted the same way. The vault database — album names, file names, sizes, dates, checksums, and the break-in log — is encrypted with SQLCipher using a key derived from your vault key. No unencrypted copy of a vault file or thumbnail is ever written to disk, including caches. The one exception is a file you export: Kept then writes an ordinary, unencrypted copy to the folder the export dialog names (Pictures/Kept for photos and videos, Music/Kept for audio, Download/Kept for other files).

Kept does not read your photo library. It receives files only when you choose them in Android's photo picker or document picker, share them to Kept from another app, or take a photo with Kept's own camera (§1.4). An original is removed only after the file is encrypted and verified, and only after you confirm. For photos and videos from the photo picker, Android shows its own confirmation dialog and nothing is deleted unless you approve it there. For files from the document picker, Android shows no dialog: Kept shows its own confirmation first and, if you agree, deletes the file through the access you granted in the picker. For files shared to Kept from another app, Kept either asks Android through the same dialog or, when that is not possible, leaves the file where it is, tells you it is still in your gallery, and lets you select it in the photo picker for removal.

1.2 Your keys

Your vault key is generated on your phone. It is stored only in encrypted ("wrapped") form, in three variants:

wrapped with a key derived from your PIN (Argon2id) combined with a random secret that is protected by your phone's hardware key store, so the PIN-protected copy only works on the phone that created it;
wrapped with a key that your phone's hardware key store releases only after a successful fingerprint unlock (or face unlock, on phones where Android rates it as strong biometrics), if you enabled biometrics;
wrapped with your recovery key, which is shown to you once during setup and which we never see.

Changing your PIN, re-enrolling biometrics, or rotating the recovery key re-wraps the key; your files are not re-encrypted. The unwrapped key lives only in memory while the vault is open and is wiped when the vault locks, when the screen turns off, when Kept goes to the background for longer than your auto-lock setting, or when Android reclaims memory.

Because of this design, we cannot recover your vault. If you forget your PIN and no longer have your recovery key, the files in the vault cannot be opened by anyone, including us.

1.3 App settings

Settings that Kept needs while the vault is locked — auto-lock time, re-lock policy, disguise mode, break-in threshold, wrong-attempt lockout counter, onboarding progress, your analytics choice, and a cached copy of your subscription status — are stored in an encrypted settings store keyed by your phone's hardware key store. They are not protected by your PIN and they never leave the device.

1.4 Camera: break-in pictures and Kept's camera

Kept uses the camera for two things only.

Break-in pictures. If you enable break-in alerts, Kept can take one picture with the front camera after a number of wrong PIN attempts that you choose (three by default), on the vault lock screen or on an app-lock screen, with no preview and no flash. The picture is encrypted into your vault as an item in a hidden album, together with the time, the PIN that was attempted, and which app was being opened. Android asks for the camera permission the first time this could happen; if you decline, Kept records the attempt without a picture.

Kept's camera. When you choose "Take a photo" in the vault, Kept shows a viewfinder and takes photos straight into the vault. Each photo is held in memory and encrypted before anything is written; it is never saved to your gallery or anywhere unencrypted. Kept takes photos only, never video or sound. Android asks for the camera permission when you first open it; if you decline, Kept explains why it needs the camera and offers to ask again.

Pictures of either kind are never sent anywhere, and Kept does not use the camera at any other time.

1.5 App lock (Usage access and Display over other apps)

The app lock needs two system permissions, which Kept requests only when you turn the feature on:

Usage access (PACKAGE_USAGE_STATS). Kept reads the system's record of which app is in the foreground so it can tell that an app you locked has just opened. Kept reads only the package name and the time of the foreground change; it does not read the content of other apps, does not keep a history of the apps you use, and never sends this information anywhere.
Display over other apps (SYSTEM_ALERT_WINDOW). Kept draws its lock screen on top of the locked app. Nothing other than the lock screen is ever drawn in this window — no ads, no other content.

To do this while you use your phone, Kept runs a foreground service with a persistent notification. The list of locked apps is stored in Kept's encrypted settings on this phone (it has to be readable while your vault is locked). To offer you a list of apps to lock, Kept asks Android for the apps that have a launcher icon; it does not use the "query all packages" permission and does not send the list anywhere. Kept may suggest that you turn off battery optimisation for it in Android Settings so the lock keeps running; you can leave it as it is.

Kept does not use an accessibility service or device-administrator rights.

1.6 Notifications

Kept shows notifications for import progress, for the app-lock service while it is running, for backup reminders, and if the app lock stops working because a permission was revoked. Notifications never contain vault content.

1.7 Calculator disguise

You can make Kept appear on your home screen as a calculator. This changes only the launcher icon and label; Kept is still listed as "Kept" in your phone's Settings and on Google Play. Nothing about the disguise involves data leaving the device.

2. Backup

2.1 Backup folder you choose

During setup Kept asks you to pick a folder (on the phone, an SD card, or a folder provided by another app such as a cloud-drive client). Kept writes encrypted copies of your vault there: the encrypted files, an encrypted snapshot of the vault database, the wrapped-key file, and a manifest of checksums. Everything in the backup folder is ciphertext; the wrapped-key file cannot be opened without your recovery key, and the PIN-protected copy inside it only works on the phone that created it.

What can be seen by anyone who can browse that folder: the number of files, their sizes and modification times, a random vault identifier, the checksums of the encrypted files, the length of your PIN, the key-stretching parameters, and whether a vault is a decoy (these are stored unencrypted in the key file, so a decoy vault is not hidden from someone who can read your backup folder). What cannot be seen: any photo, video, name, album, or key.

If the folder you chose is synced to a cloud service by another app, that other app's privacy policy applies to the encrypted files it uploads. Kept itself does not upload anything.

You can skip the backup step. If you do, Kept warns you that uninstalling the app or clearing its data will permanently delete your vault, and reminds you again every seven days.

2.2 Optional Google Drive backup (only if you enable it)

A later version may offer an optional backup to your own Google Drive account, using the app-private "appDataFolder" area (OAuth scope https://www.googleapis.com/auth/drive.appdata). If and when this ships:

it is off by default and only starts after you sign in with Google and grant that scope;
Kept uploads the same encrypted files as in §2.1, to your Drive account, not to us;
Kept cannot see any other file in your Drive, and you can revoke access at any time in your Google Account settings (Security → Third-party apps);
Google's privacy policy applies to data stored in your Google account.

Kept's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This section will be updated, and the effective date changed, before Drive backup is released.

3. Data that can leave your phone

Kept has no backend. The only network traffic is to the following services, each of which has its own privacy policy:

3.1 Google Play Billing (subscriptions)

Pro subscriptions are sold and processed by Google Play. We do not receive your name, address, or payment details. The app receives a purchase token and the subscription state from Google Play and caches that state on the device to decide which features are unlocked. Google's handling of your purchase is described in Google's privacy policy.

3.2 Ads (free tier only) — Google AdMob

If you use Kept without a Pro subscription, ads from Google AdMob appear while the vault is open: an app open ad when the vault home comes up after you unlock, banners at the top of the Vault, Albums, App lock, Disguise settings, Break-in alerts and Settings screens, ad cards in the album list and when an import finishes, and full-screen ads when you choose a backup folder in Settings and on some moves between the vault's screens (never within a minute of the previous one). Ads are never shown on the vault lock screen, on app-lock screens, in the calculator, in the photo viewer or camera, or in onboarding, and ads never see your vault content. Pro removes ads entirely.

To serve and measure ads, the AdMob SDK collects your device's advertising ID and other device identifiers, coarse location derived from your IP address, and information about the ads shown and tapped. Where required (for example in the EEA, UK, and Switzerland) Kept shows the Google User Messaging Platform (UMP) consent form before any ad is loaded, and you can change your choice later in Settings → Privacy options. You can also reset or delete your advertising ID in Android Settings → Privacy → Ads. AdMob's data practices are described at Google's advertising privacy page and How Google uses information from sites or apps that use our services.

Kept does not use ad mediation partners beyond Google unless this policy is updated to list them.

3.3 Usage statistics — Firebase Analytics

To understand which features are used and to decide what to improve, Kept sends a small set of anonymous events to Google Analytics for Firebase, for example "import completed" with the number of files and bytes, "backup verified", "app lock enabled" with the number of locked apps, or "paywall viewed". Events never contain file names, album names, photo content, the names of locked apps, PINs, or your recovery key, and Kept does not attach any user identifier to them. Firebase assigns a random, app-specific installation identifier to your device to group events; advertising-ID collection for analytics is disabled.

Usage statistics are off until you turn them on: Kept asks once, and you can change your answer at any time in Settings → Privacy. While they are off, no analytics events are sent. The steps of the first setup (or of a restore from your backup folder) happen before Kept can ask; their events wait in the app's memory, are sent if you say yes, and are discarded if you say no. They are never written to storage.

3.4 Crash reports — Firebase Crashlytics

If Kept crashes, or runs into an unexpected error it recovers from (for example a vault database that will not open or a background job that fails), a report is sent to Firebase Crashlytics: the type of error and the stack trace (where in Kept's code it happened), the app version, the Android version, the device model, free memory and storage at the time, and a random Crashlytics installation identifier. Kept removes every error message before a report is sent, because Android's error messages can contain file names or locations; reports therefore never contain file names, URIs, PINs, keys, or vault content. Each kind of error is reported at most once each time Kept starts.

3.5 What is never sent

Your photos, videos, audio, other vault files, thumbnails, album names, file names, your PIN, your recovery key, your vault keys, break-in pictures, the list of apps you locked, and the apps you open are never transmitted by Kept to us or to any third party.

All traffic listed above uses TLS (HTTPS).

4. Permissions summary

Permission (Android name)	Used for	Data that leaves the device
Camera (`CAMERA`)	Break-in pictures after wrong PIN attempts, and photos you take with Kept's camera (§1.4)	None
Usage access (`PACKAGE_USAGE_STATS`)	Detecting that a locked app opened (§1.5)	None
Display over other apps (`SYSTEM_ALERT_WINDOW`)	Showing the lock screen over a locked app (§1.5)	None
Notifications (`POST_NOTIFICATIONS`)	Import progress, app-lock service, backup reminders (§1.6)	None
Foreground service (`FOREGROUND_SERVICE`, `_SPECIAL_USE`, `_DATA_SYNC`)	App-lock monitor; import and backup jobs that must finish even if you switch apps	None
Run at startup (`RECEIVE_BOOT_COMPLETED`)	Restarting the app-lock service after a reboot	None
Biometrics (`USE_BIOMETRIC`)	Fingerprint unlock (or face unlock where Android rates it as strong biometrics) through Android's biometric prompt; Kept never receives biometric data	None
Internet, network state	Google Play Billing, ads (free tier), analytics, crash reports (§3)	See §3

Kept does not request: photo/media library access (READ_MEDIA_IMAGES, READ_MEDIA_VIDEO, READ_MEDIA_VISUAL_USER_SELECTED), storage access (READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, MANAGE_EXTERNAL_STORAGE), the list of all installed apps (QUERY_ALL_PACKAGES), accessibility services, device administrator rights, location, contacts, microphone, SMS, or call logs. Our build fails automatically if any of these permissions, an accessibility service, or a device-admin receiver ever appears in the app.

5. Deleting your data

Individual items: delete them in the app. Deleted items go to the vault's trash for 7 days and are then permanently removed; you can empty the trash sooner.
Everything in the app: uninstall Kept, or use Android Settings → Apps → Kept → Clear storage. This removes the encrypted vault, the keys, and all settings from the phone. Backups in the folder you chose are ordinary files in your own storage; delete that folder to remove them. If you enabled Google Drive backup, delete Kept's app data from your Google Account (Google Drive → Settings → Manage apps).
What we hold: nothing that identifies you. Analytics and crash data are stored by Google for us under random installation identifiers, not under your name or email. Analytics event data is retained for ANALYTICS_RETENTION — set in the Firebase console; recommended 2 months and crash reports for CRASHLYTICS_RETENTION — Firebase default 90 days. If you want the analytics data associated with your installation deleted before then, email connectionlabapps@gmail.com from the phone with the app's installation identifier (Settings → Privacy → "Copy analytics ID"); we will submit the deletion request to Google.
Subscription and payment records are held by Google Play under Google's privacy policy; cancel or manage them in Google Play → Subscriptions.

We cannot delete, recover, or reset your vault for you — we never have access to it.

6. Children

Kept is not directed at children under 13 (or the applicable age of digital consent in your country) and we do not knowingly collect personal information from children. Kept's ads are configured as not child-directed. If you believe a child has used Kept and that this concerns you, contact us at connectionlabapps@gmail.com.

7. Security, honestly stated

Encryption on the phone: AES-256-GCM with per-file keys (Google Tink streaming AEAD); PIN stretched with Argon2id; key wrapping with AES-256-GCM; database encrypted with SQLCipher; hardware key store for device- and biometric-bound keys. No custom cryptography.
What this protects against: someone borrowing or stealing your phone, family members, "cleaner" apps, and anyone browsing your backup folder — they see ciphertext only, plus the key-file metadata listed in §2.1.
What it does not protect against: malware with full control of your phone while the vault is open, a rooted or compromised operating system, or losing both your phone (or PIN) and your recovery key.
Kept has not undergone an independent security audit as of the effective date. The source layout and the encryption design are documented in the app's "Security" screen.

8. Changes to this policy

We will post any change here and update the effective date at the top. Material changes (for example, releasing the optional Google Drive backup, or adding an ad-mediation partner) will also be announced in the app before they take effect.

9. Contact

Connection Lab Apps · connectionlabapps@gmail.com

Search This Blog

Connection Lab Apps