Locki Privacy Policy

Last updated: June 17, 2026

This Privacy Policy explains how Locki ("the app", "we", "us") handles information when you use the app on Android or iOS. Locki is a password manager designed so that your data stays on your own device: we do not operate a server that stores your passwords, and you are not required to create an account or provide an email address to use the app.

1. Who is responsible for your data

Locki is developed and maintained by José Bueno, an independent developer (Android application ID com.jomibusa.locki.android). For any questions about this policy or to exercise your rights, you can contact us at jomibusadeveloper@gmail.com.

2. Information we collect

Locki distinguishes between data you create inside the app (which stays encrypted on your device) and limited technical data that integrated third-party services may process so the app can run reliably and remain free.

2.1 Data you enter in the app (local, encrypted storage)

• Passwords, usernames, URLs, notes and categories saved in your vault.
• An optional master password and your favorites settings.
• App preferences (for example, auto-lock timing or screenshot blocking).

All of this information is stored exclusively on your device, inside a database encrypted with AES-256 (SQLCipher). The encryption key is protected by your operating system's secure storage (Android Keystore on Android, Keychain on iOS) and, if you enable it, by your fingerprint or face recognition. We do not transmit, sync, or store this information on our own or any third-party servers. Locki has no backend and no cloud database: there is no account system, email registration, or remote login of any kind.

2.2 Biometric data

If you enable fingerprint or face unlock, biometric verification is performed entirely by your device's operating system (BiometricPrompt on Android, Face ID/Touch ID on iOS). Locki never accesses, receives, or stores your biometric data; it only receives a simple "authentication succeeded" or "failed" result from the operating system.

2.3 Backups

Locki lets you export your vault to a file encrypted with a passphrase you choose, and later import it (replacing or merging your data). This file is saved to storage you select on your own device. Locki does not upload backups to any server or cloud service.

2.4 Technical information collected by third-party services

To keep the app stable and to fund its free version, we integrate the following Google services, which may process limited technical data under their own privacy policies:

• Firebase Crashlytics: automatically collects crash reports, including technical device information (device model, OS version, error stack trace). It does not include the contents of your password vault.
• Google AdMob: displays ads in the free version of the app. AdMob may collect advertising identifiers and ad interaction data for personalization and measurement purposes, subject to your consent (see section 2.5).
• Google User Messaging Platform (UMP): stores and manages your advertising consent choice, in compliance with regulations such as the GDPR.
• Google Play Billing: if you purchase the Premium version, the payment is processed entirely by Google Play. Locki does not receive or store any credit card or payment information; it only receives confirmation that a purchase was completed.

The current version of the app includes the Firebase Analytics SDK, but Locki's code does not emit any custom analytics events.

2.5 Your advertising consent

The first time you open the app (in regions where applicable, such as the European Economic Area and the United Kingdom), you will be shown a Google consent form (UMP) where you can choose whether to allow personalized ads. You can change this choice at any time from the app's settings.

3. Device permissions

Locki requests only the following permissions:

• Internet access and network state: required to display ads, send crash reports, and verify Google Play purchases.

Locki does not request access to your camera, microphone, location, contacts, calendar, or photo library. The Autofill feature is available but disabled by default, and only becomes active if you manually enable it in your device's system settings.

4. How we protect your information

• AES-256 encryption of the entire local database via SQLCipher.
• The encryption key is protected by the Android Keystore / Apple Keychain and, optionally, biometrics.
• Your master password is never stored in plain text: it is derived using a key derivation function (KDF) with salt and iterations.
• Automatic app lock after inactivity or when the app goes to the background.
• Optional screenshot blocking to prevent visual leaks of sensitive information.

5. Sharing data with third parties

We do not sell or share the contents of your vault (passwords, usernames, notes) with anyone, under any circumstances. The only data that may be processed by third parties is the technical data described in section 2.4, and only by the service providers mentioned (Google Firebase, Google AdMob, Google Play Billing), under their own privacy policies:

• Google Firebase: firebase.google.com/support/privacy
• Google AdMob / Google Ads: policies.google.com/technologies/ads
• Google Play Billing: policies.google.com/privacy

We do not transfer information to third parties for our own commercial purposes beyond the services described in this policy.

6. Data retention and deletion

Since all of your data is stored locally, you have full control over its retention: you can delete individual passwords, categories, or your entire vault from within the app, or uninstall the app, which permanently removes the encrypted database and any associated configuration files from your device. Crash reports sent to Firebase Crashlytics are retained according to Google's retention policies and do not contain the contents of your vault.

7. Children's privacy

Locki is not directed at children under 13, and we do not knowingly collect information from children under that age. If we become aware that information from a child was collected without appropriate consent, we will delete it.

8. Your rights

Because Locki does not maintain a user account or a remote database containing your personal information, you can exercise your rights of access, correction, or deletion directly within the app (by editing or deleting your data) or by uninstalling it. For any questions related to the technical data processed by the third-party services mentioned above, you can contact us at jomibusadeveloper@gmail.com or exercise your rights directly with Google through the links in section 5.

9. International data transfers

The third-party services we integrate (Google Firebase, AdMob, Play Billing) may process technical data on servers located outside your country of residence, including the United States, under the transfer mechanisms and safeguards described in Google's own privacy policies.

10. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the app or applicable law. If we make significant changes, we will indicate this within the app or by updating the "Last updated" date on this document. We recommend reviewing this policy periodically.

11. Contact us

If you have questions about this Privacy Policy or about how your data is handled, please contact us at: jomibusadeveloper@gmail.com