Skip to content
NASCENTRA

KiWi Vault Privacy Policy

Effective Date: November 2, 2026

Developer: Nascentra Labs

Application: KiWi Vault for Android (package com.raymond.kiwi_vault)

1. Introduction, Scope and Controller

This Privacy Policy explains how KiWi Vault (the “Application”), an Android application published on Google Play by Nascentra Labs (“Nascentra”, “we”, “us” or “our”), handles information when you install and use it. KiWi Vault is an offline-first privacy vault that lets you hide photos, videos, audio, documents, other files and private notes behind a lock, and offers disguise, decoy and intruder-detection features. This Policy applies to the Application, to its Google Play listing, and to any communications you have with us about the Application. It does not apply to Google Play, Google Play services, your device manufacturer, your operating system or any other third-party product, each of which is governed by its own privacy terms. Because the Application is designed to keep your vault content on your device and does not operate any developer servers, Nascentra does not receive, host or have access to the content you place in the vault. To the limited extent Nascentra processes personal data, for example when you contact us for support, Nascentra Labs acts as the controller (or “business”, “data fiduciary” or equivalent term under applicable law). For on-device processing that you initiate and control, such as storing your own files or capturing intruder photos, you decide what is processed and why. This Policy replaces all earlier versions of the KiWi Vault privacy policy. By using the Application you acknowledge the practices described here; where the law requires consent, we ask for it separately through Android permission prompts or in-app choices.

2. Summary of Our Privacy Practices

In short, KiWi Vault is built so that your private material stays with you. The Application has no user account, no registration, no cloud synchronisation and no developer servers. It contains no advertising, no analytics software development kits, no crash-reporting services and no tracking technologies, and it does not sell, rent or share personal information for advertising. Items you hide are copied into the Application’s private storage on your own device, notes are stored in a local database on the device, and your PIN, password, pattern, security-question answers and recovery code are stored only as salted cryptographic hashes. Optional features such as intruder detection, Vault-to-Vault sharing and smart reminders run on your device and can be turned off. Purchases of KiWi Vault Premium are processed by Google Play, not by us, and we never see your payment card details. Because Android backup is disabled for the Application and we hold no copy of anything you store, we cannot restore your vault if your device is lost, reset or the Application is uninstalled. The only personal data we ordinarily receive is what you choose to send us when you ask for support, together with limited order records Google Play makes available to developers. This summary is provided for convenience; the detailed sections below govern, and they explain the legal rights available to you under the laws of the European Union, the United Kingdom, Switzerland, the United States and many other jurisdictions.

3. Information We Do Not Collect

We want to be precise about what Nascentra does not receive. We do not collect, view, transmit or store on any server the photos, videos, audio recordings, documents, files or notes you place in the vault. We do not collect your name, email address, telephone number or postal address through the Application, because the Application does not ask you to create an account. We do not collect your precise or approximate location; although Android may require location permissions for nearby device discovery, the Application does not use them to determine, record or transmit where you are. We do not collect your contacts, call logs, SMS messages, calendar, browsing history or list of installed applications. We do not collect advertising identifiers, device fingerprints or persistent cross-app identifiers, and we do not build behavioural or marketing profiles. We do not receive your fingerprint, face data or any other biometric information, because biometric verification is performed entirely by Android and the device’s secure hardware. We do not receive intruder photos, usage patterns, search queries, recovery answers or your credentials. We do not use cookies, web beacons, pixels or similar technologies inside the Application. Information that exists only on your device and is never transmitted to us is not “collected” by Nascentra in the sense used by data protection laws and by the Google Play Data safety section, but we nevertheless describe it in this Policy so that you understand exactly what the Application does with it locally.

4. Vault Content Stored on Your Device

When you hide an item, the Application copies it from your device’s shared storage into the Application’s private, sandboxed internal storage on the same device. You may then choose to delete the original from shared storage so that it no longer appears in your gallery, file manager or other apps; if you do not, the original remains where it was. When you unhide an item, the Application restores a copy to shared storage, where it becomes visible to other applications again under the normal Android rules. Private notes you write, and the catalogue that records which items are in the vault and how they are organised, are kept in a local database inside the Application’s private storage. Metadata associated with items, such as file names, sizes, types, dates and folder organisation, is stored in the same place and is used only to display, sort and search your vault. None of this material is uploaded to Nascentra or to any cloud service operated on our behalf. Because vault content may include highly sensitive personal data about you or about other people, including images of identifiable individuals, health information, financial records or intimate content, you remain responsible for having the right to store it and for complying with any law that applies to your possession of it. Nascentra has no technical ability to inspect, moderate or remove vault content, and this Policy does not create any obligation for us to do so.

5. How Vault Content Is Protected

We describe the Application’s protection measures accurately so that you can make informed decisions. Vault items are stored in the Application’s private internal storage, which is protected by Android’s application sandbox: on a device that has not been rooted or otherwise compromised, other applications cannot read that storage. On modern Android devices this storage is also protected by the device-level encryption provided by the operating system, which depends on your device, its Android version and your screen lock settings. Your credentials are not stored in readable form; they are stored as salted, iterated cryptographic hashes using PBKDF2. The Application’s security settings are kept in encrypted preferences protected by an AES-256 key held in the Android Keystore. Some items are additionally encrypted by the Application using AES-256-GCM. However, not every file in the vault is individually encrypted by the Application, and the principal protection for most vault contents is the combination of the application sandbox and device encryption, not a separate layer of file encryption performed by KiWi Vault. As a result, a person with physical access to an unlocked device, with root or administrator privileges, with forensic tools or with malware running on the device may be able to access vault contents. You can strengthen protection by using a strong device screen lock, keeping Android updated, not rooting your device and choosing a strong vault credential. The Application also locks automatically when you leave it.

6. Credentials, Hashing and Biometric Unlock

You can protect the vault with a PIN, a password or a pattern. When you set or change a credential, the Application derives a salted, iterated hash using PBKDF2 and stores only that hash, together with the salt, on your device. When you unlock, the Application hashes what you enter in the same way and compares the results. The original credential is not stored and is not transmitted to Nascentra, which means we cannot tell you your credential or reset it for you. The same hashing approach is applied to your security-question answers and your 8-digit recovery code. You may also choose biometric unlock using your fingerprint or face, where your device supports it. Biometric unlock uses Android’s BiometricPrompt, which asks the operating system to verify you against biometric data you previously enrolled in your device settings. The Application receives only a success or failure result. Your biometric templates remain in the device’s secure hardware, are never accessible to the Application, and are never transmitted to Nascentra. KiWi Vault therefore does not collect, store or process biometric identifiers or biometric information within the meaning of laws such as the Illinois Biometric Information Privacy Act, and it does not perform facial recognition. Biometric unlock is optional, and you can disable it at any time and rely on your PIN, password or pattern instead. If biometric verification fails or is unavailable, you will be asked for your primary credential.

7. Disguise Modes, Decoy Mode and Alternative Icons

The Application offers features that help conceal the existence of the vault. Calculator lock and Clock lock make the entry screen of the Application look and behave like a calculator or a clock, so that the vault opens only when you enter your credential in the disguised interface. Alternative launcher icons let you change the icon and name the Application displays on your home screen. These features change only how the Application appears on your device; they do not cause any information to be sent to Nascentra or to third parties. Decoy mode lets you set a separate decoy credential. When the decoy credential is entered, the Application opens an empty vault instead of your real vault. The decoy credential is hashed in the same way as your primary credential, and the fact that the Application is currently in decoy state is held only in memory while the Application is running; it is not written to a log or transmitted anywhere. Disguise and decoy features are provided to protect your privacy against casual inspection. They are not designed to defeat forensic analysis, and they must not be used to obstruct lawful investigations, to deceive a court or authority, or to conceal unlawful material. You are responsible for using them in accordance with the law that applies to you. To avoid revealing the vault, the Application does not send reminder notifications while a Calculator or Clock disguise is active, as explained in the section on reminders and notifications below.

8. Recovery Options and Recovery Reminders

Because Nascentra does not hold your credentials and operates no account system, recovery of access depends entirely on options you set up on your device. KiWi Vault lets you configure security questions and an 8-digit recovery code. Your answers and your recovery code are stored only as salted PBKDF2 hashes in the Application’s private storage; they are not readable by us and are not transmitted to us. To reduce the risk of permanent lock-out, the Application occasionally displays an in-app reminder, approximately twice a month, asking whether you still remember your recovery option. This reminder is generated on the device, does not record your answer anywhere outside the device, and does not reveal your recovery information. We strongly recommend that you set at least one recovery option and keep your recovery code in a safe place that is separate from your device. If you forget your credential and cannot use any recovery option, Nascentra cannot unlock the vault, reset your credential, bypass the lock or retrieve your content, and any support request we receive will not change that outcome. You should treat your recovery code like a key: anyone who obtains it and has access to your device may be able to reset your vault credential. Do not send your credentials, recovery code or security answers to us in support messages; we will never ask for them.

9. Intruder Detection: What Is Captured

Intruder detection is an optional feature that is designed to help you learn whether someone has tried to open your vault without permission. If you enable it and grant the camera permission, the Application can silently take a photograph using the device’s front camera when an incorrect PIN, password or pattern is entered. The Application stores that photograph locally in its private storage together with the time of the attempt and the unlock method that was attempted (PIN, password or pattern). Intruder photographs can be viewed only from inside your unlocked vault, and you can delete them at any time. The Application does not perform facial recognition, does not extract facial geometry or any other biometric template from intruder photographs, does not compare photographs against any database, and does not upload photographs to Nascentra or to any other party. The camera is not used for any other purpose, and it is not activated in the background outside a failed unlock attempt. A photograph taken by intruder detection may depict a person other than you, such as a family member, a colleague or a stranger, and may also capture surroundings or bystanders. Such a photograph is personal data of the person depicted. Nascentra does not receive it and is not the controller of it; you, as the user who enables the feature and keeps the photographs, determine whether and how they are captured, retained and used. You can disable intruder detection or revoke the camera permission in Android settings at any time, after which no further photographs will be taken.

Taking a photograph of a person without their knowledge can be regulated by law, and the rules differ widely. You are solely responsible for using intruder detection lawfully. Depending on where you are and whose device it is, you may need to give notice to, or obtain consent from, people who might use or handle your device; you may be restricted by laws on photographing people, on covert recording, on workplace monitoring and on household or domestic surveillance; and you may have obligations under data protection law. In the European Union, the United Kingdom and Switzerland, the “household exemption” for purely personal activity may not apply in every case, for example where a device is used in an employment setting or where photographs are shared with others, in which case you may become a controller with duties under the GDPR, the UK GDPR or the Swiss nFADP. In the United States, biometric privacy statutes such as the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act and Washington’s biometric identifier law regulate the capture of biometric identifiers. KiWi Vault does not create biometric identifiers or templates, but captured images remain personal data of the people depicted, and you should not use them to identify, track or profile anyone. You must not use intruder photographs to harass, threaten, shame, extort or publish images of others. If you are unsure whether the feature is lawful in your situation, keep it switched off or seek independent legal advice.

11. Vault-to-Vault Sharing and Google Nearby Connections

Vault-to-Vault sharing lets you send selected files directly from your vault to another nearby device on which KiWi Vault is installed. The feature uses Google’s Nearby Connections API, which is part of Google Play services, to discover nearby devices and to establish a direct connection over Bluetooth, Bluetooth Low Energy and Wi-Fi. Files are transferred device-to-device; they do not pass through any server operated by Nascentra, and Nascentra receives no copy of the files, the names of the devices involved or any record that a transfer took place. During discovery, nearby devices may see an identifier or name advertised by your device for the purpose of establishing the connection. Google Play services performs discovery and connection management under Google’s own terms and privacy policy, and Google may process technical information needed to operate that service; Nascentra does not control that processing. Using this feature requires Bluetooth, Nearby Wi-Fi devices, Wi-Fi state and, on some Android versions, location permissions, as explained in the permissions sections below. Once a file is received on another device, it is under the control of the recipient, and we cannot recall it. As the sender, you are responsible for ensuring that you have the right to share each file, that the recipient wishes to receive it, and that sharing does not infringe anyone’s privacy, intellectual property or other rights. Only connect to devices you recognise and accept transfers only from people you trust.

KiWi Vault can receive files that you share to it from other applications through the standard Android share sheet. When you choose KiWi Vault as the destination, the sending application passes the selected file to the Application, which copies it into private storage in the same way as items hidden from within the Application. The sending application may have its own privacy practices, and the file may already exist in that application, in shared storage or in a cloud service connected to it; importing a copy into the vault does not delete it from those places unless you remove it there yourself. Nascentra does not receive information about which applications you share from or what you import. The Application also provides an in-vault search function that lets you find items and notes by name or content stored in the local catalogue. Searches are performed entirely on the device against the local database. Search terms are not transmitted to Nascentra, are not used to build a profile, and are not shared with third parties. Some search suggestions or recent results may be kept locally to make the feature convenient, and they are removed if you clear the Application’s data or uninstall it. Because imported files can contain embedded metadata, such as the date, device model or, in some photographs, location coordinates recorded by the camera that created them, you may wish to review or remove such metadata before sharing files onward using Vault-to-Vault sharing or by unhiding them.

13. Permissions: Camera, Storage and Media

Android permissions allow the Application to access device functions only after you grant them, and you can revoke any of them in Android settings, although some features will then stop working. The CAMERA permission is used only by intruder detection to take a front-camera photograph after an incorrect unlock attempt; it is not used to record video or audio and is not needed if you leave intruder detection off. All-files access (MANAGE_EXTERNAL_STORAGE) is requested on Android 11 and later so that the Application can move files you select into the vault and, if you choose, delete the originals from shared storage, and so that it can restore files to their original locations when you unhide them. Google Play permits this permission for applications whose core purpose requires broad file management, and the Application uses it only for actions you initiate; it does not scan, catalogue or transmit the contents of your storage. READ_EXTERNAL_STORAGE is requested on Android 12 and lower, and WRITE_EXTERNAL_STORAGE on Android 10 and lower, to provide the same functions on older versions of Android. READ_MEDIA_AUDIO allows you to select audio files to hide on newer Android versions. None of these permissions is used to send any information to Nascentra, and files accessed through them remain on your device unless you yourself share them.

14. Permissions: Bluetooth, Nearby Wi-Fi and Location

The following permissions are used only for Vault-to-Vault sharing. BLUETOOTH and BLUETOOTH_ADMIN are requested on Android 11 and lower to use Bluetooth for discovering and connecting to nearby devices. On Android 12 and later, BLUETOOTH_SCAN is used to find nearby devices running KiWi Vault and is declared with the “neverForLocation” flag, which tells Android that the Application does not derive your physical location from Bluetooth scan results; BLUETOOTH_ADVERTISE allows your device to be discovered by the receiving device; and BLUETOOTH_CONNECT allows a connection to be established with a device you choose. NEARBY_WIFI_DEVICES, also declared with “neverForLocation”, together with ACCESS_WIFI_STATE and CHANGE_WIFI_STATE, allow the Nearby Connections API to use Wi-Fi to transfer files faster. ACCESS_COARSE_LOCATION and ACCESS_FINE_LOCATION are requested because some versions of Android require location permission before an application may scan for nearby Bluetooth or Wi-Fi devices, since such scans could theoretically reveal location. KiWi Vault does not use these permissions to determine, record, store or transmit your location, does not access GPS for any other purpose, and does not share location with Nascentra or third parties. If you never use Vault-to-Vault sharing, you need not grant any of these permissions, and declining them does not affect the rest of the Application.

15. Permissions: Biometrics and Notifications

USE_BIOMETRIC allows the Application to ask Android to display the system BiometricPrompt so that you can unlock the vault with a fingerprint or face enrolled on your device. As explained above, the Application receives only a pass or fail result and never receives, stores or transmits biometric data. The permission is normally granted automatically at installation because it does not expose personal data, and biometric unlock is used only if you turn it on in the Application’s settings. POST_NOTIFICATIONS is requested on Android 13 and later so that the Application can display notifications, such as smart reminders and recovery-related prompts. Notification content is designed to be discreet and does not include previews of your vault items or notes. Notifications are generated locally on the device and are not sent through a push messaging service operated by Nascentra; we have no means of sending you notifications remotely. You can refuse or revoke the notification permission at any time in Android settings, or turn off reminders within the Application, without affecting the vault’s core functions. Android itself, and certain device manufacturers, may record information about notifications displayed on the device in accordance with their own policies, which are outside our control. We recommend that you review your device’s lock-screen notification settings if you prefer that notifications from any application not be visible while your device is locked.

16. On-Device Usage Patterns, Reminders and Suggestions

To make reminders helpful rather than intrusive, the Application keeps a record on your device of certain usage patterns, such as the days of the week and hours of the day at which you open the Application, and whether you respond to or ignore reminders. The Application uses these patterns locally to time smart reminders and to show “For You” suggestions inside the Application, for example a prompt to review recently hidden items or to set up a recovery option. The Application sends at most one reminder notification per day, respects quiet hours, reduces the frequency of reminders when they are ignored, and never sends reminders while a Calculator or Clock disguise is active, so that a notification does not reveal the existence of the vault. Usage pattern data stays on your device. It is not transmitted to Nascentra, is not combined with information from other sources, is not used for advertising, and is not used to make decisions that produce legal or similarly significant effects on you. It therefore does not constitute profiling in the sense regulated by Article 22 of the GDPR or automated decision-making under comparable laws. You can turn reminders off in the Application’s settings, revoke the notification permission, or clear the Application’s data, which deletes the stored patterns. Where the ePrivacy Directive or similar rules apply to the storage of information on your device, this storage is strictly necessary to provide a feature you have chosen to use, and you can disable it at any time.

17. Recently Deleted and Data Retention

When you delete an item from the vault, it is first moved to a Recently Deleted area inside the Application’s private storage. Items in Recently Deleted are kept for 30 days so that you can restore them if you deleted them by mistake, after which the Application deletes them permanently and automatically. You may permanently delete items from Recently Deleted earlier at any time. Once permanently deleted, an item is removed from the Application’s storage and catalogue; because deletion relies on the device’s storage system, residual data may persist in unallocated flash memory until it is overwritten, which is outside the Application’s control. Other on-device data, including notes, intruder photographs, usage patterns and settings, is retained until you delete it within the Application, clear the Application’s data in Android settings or uninstall the Application. Nascentra itself retains only limited information. Support communications are kept for as long as necessary to handle your request and any follow-up, and for a reasonable period afterwards to maintain a record of our dealings, unless a longer period is required to comply with law or to establish, exercise or defend legal claims. Order records made available by Google Play are retained for as long as needed for accounting, tax, fraud prevention and legal compliance purposes. When retention is no longer necessary, we delete the information or, where deletion is not feasible, we isolate it from further use.

18. No Cloud Backup and Risk of Data Loss

Android’s cloud and automatic backup is disabled for KiWi Vault, which means vault contents, notes, intruder photographs, settings and credentials are not backed up to Google Drive, to your Google account, to Nascentra or to any other service. This design choice reduces the risk that sensitive material leaves your device without your knowledge, but it has an important consequence: your vault exists only on your device. If you uninstall the Application, clear its data, perform a factory reset, lose your device, have it stolen or damaged, or forget your credentials and all recovery options, your vault contents may be permanently lost. Device transfer tools offered by your phone manufacturer or by Android may also not carry vault contents to a new device. Nascentra has no copy of your content, holds no keys that could unlock it, and cannot recover anything on your behalf, whether you contact us or a court or authority requests it. Before uninstalling the Application, resetting your device or changing phones, you should unhide any items you wish to keep and store them securely by other means. You are responsible for maintaining your own backups of anything important. Nothing in this Policy limits any rights you have under mandatory consumer protection law, but the absence of backup is an inherent characteristic of the Application that you accept when you use it.

19. Payments and Google Play Billing

KiWi Vault offers optional premium features under the name KiWi Vault Premium. Premium is sold through Google Play Billing as auto-renewing weekly, monthly or annual subscriptions, or as a one-time lifetime purchase. A free trial may be offered on some plans, as shown on the Google Play purchase screen. Prices are set in Google Play and displayed in your local currency. All payments are processed by Google under the Google Play Terms of Service and Google’s privacy policy. Nascentra never receives or sees your payment card number, bank details or billing address. Google may make order records available to us through the Google Play Console, such as an order identifier, the product purchased, the country, the date and the status of the transaction, including cancellations and refunds. We use this information only to manage purchases, verify entitlements, handle support requests, prevent fraud, and meet accounting and legal obligations. The Application uses Google Play Billing on the device to confirm whether you are entitled to Premium; this check is handled by Google Play and does not involve any Nascentra server. Purchases are associated with your Google account and can be restored on a device signed in to the same account. You can cancel a subscription at any time in your Google Play subscription settings; uninstalling the Application does not cancel a subscription. Refunds are handled under Google Play’s policies and any mandatory consumer law that applies to you.

20. Google Play Services, In-App Updates and Other Third Parties

The Application relies on a small number of Google components that are part of the Android and Google Play ecosystem. Google Play Billing processes purchases as described above. Google’s Nearby Connections API, part of Google Play services, enables Vault-to-Vault sharing. Google Play’s in-app update library allows the Application to check whether a newer version is available on Google Play and to prompt you to install it; that check is performed by Google Play and may involve Google processing information about your device and the installed version. Google Play itself may collect information about installations, device characteristics, crashes reported through Android’s own mechanisms and purchases in accordance with Google’s privacy policy, which you can read at policies.google.com/privacy. Google acts independently in relation to that processing, and Nascentra does not control it. Nascentra may see aggregated, de-identified statistics in the Google Play Console, such as installation counts and ratings, which do not identify you. Apart from these Google components, the Application does not integrate third-party advertising networks, analytics providers, social media plug-ins, crash-reporting services or data brokers. We do not sell personal information, and we do not disclose personal information to third parties for their own marketing purposes. If we ever add a third-party service that processes personal data, we will update this Policy and the Google Play Data safety section before doing so.

21. Support Communications

If you contact us by email at nascentra@gmail.com, by WhatsApp at +923477419855, or through our contact page at nascentra.com/contact, we will receive the information you choose to provide, such as your name, email address or telephone number, the content of your message, any attachments, and technical details you include, such as your device model or Android version. We use this information only to respond to your request, to troubleshoot problems, to handle purchase or refund questions, to improve the Application based on your feedback, and to keep a record of our communications. We do not use support information for advertising and do not add you to marketing lists without your consent. Email and WhatsApp are operated by third-party providers, namely Google and WhatsApp (Meta), which process message data under their own terms and privacy policies, and messages may be stored on their infrastructure in various countries. Please do not send us vault content, intruder photographs, credentials, recovery codes or security answers, or sensitive information about other people, as we do not need them to help you and cannot use them to unlock your vault. If you need to share a screenshot, remove any private information before sending it. You can ask us at any time to delete your support correspondence, subject to any legal obligation to retain it.

Where the EU General Data Protection Regulation (GDPR), the UK GDPR together with the Data Protection Act 2018, or the Swiss Federal Act on Data Protection (nFADP) applies to personal data that Nascentra processes, we rely on the following legal bases. We process support communications on the basis of our legitimate interests in responding to enquiries and improving the Application (Article 6(1)(f)), or, where your enquiry relates to a purchase or to the provision of the Application, because processing is necessary to perform our contract with you (Article 6(1)(b)). We process order records made available by Google Play to perform our contract, to comply with legal obligations such as tax and accounting rules (Article 6(1)(c)), and for our legitimate interests in preventing fraud and resolving disputes. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and concluded that the processing is limited and expected. Processing that occurs only on your device under your control, such as storing vault content, hashing credentials, taking intruder photographs or recording usage patterns, is not processing by Nascentra as controller. Access to and storage of information on your device is limited to what is strictly necessary for features you request, consistent with Article 5(3) of the ePrivacy Directive and its national implementations. Under the nFADP, Nascentra processes personal data in accordance with the principles of lawfulness, good faith, proportionality, purpose limitation and transparency.

23. International Data Transfers

Because the Application does not transmit vault content or usage data to Nascentra, international transfers of personal data by Nascentra are limited to support communications and order records. Nascentra Labs may handle that information outside the European Economic Area, the United Kingdom and Switzerland, and the email, messaging and Google Play services through which we receive information may store data in data centres located in various countries, including the United States. When personal data from the EEA, the UK or Switzerland is transferred to a country that has not been recognised as providing an adequate level of protection, we rely on appropriate safeguards where they are required, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or equivalent Swiss mechanisms, as incorporated into the terms of the service providers we use, or on derogations permitted by law, such as transfers necessary to respond to a request you have made. Google and WhatsApp (Meta) maintain their own transfer mechanisms, which are described in their privacy policies. Similar principles apply to transfers subject to other laws that regulate cross-border transfers, such as Brazil’s LGPD, China’s PIPL, India’s DPDP Act, South Africa’s POPIA and the UAE PDPL. You may contact us to obtain more information about the safeguards relevant to your data. Where you choose to contact us, you understand that your message will be processed in the countries where those communication services operate.

24. Your Rights in the EU, UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the following rights regarding personal data that Nascentra processes, subject to conditions and exceptions in the law. You may request access to your personal data and a copy of it; rectification of inaccurate data; erasure of your data; restriction of processing; and portability of data you provided to us, in a structured, commonly used and machine-readable format. You may object at any time to processing based on our legitimate interests, and we will stop unless we have compelling legitimate grounds or need the data for legal claims. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of earlier processing. You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects; we do not make such decisions. You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where an alleged infringement occurred, including the UK Information Commissioner’s Office and the Swiss Federal Data Protection and Information Commissioner. Because we do not hold vault content or on-device data, most such information can be accessed, exported or deleted directly by you within the Application. We will respond to verified requests within one month, which may be extended where permitted by law, and we will not charge a fee unless a request is manifestly unfounded or excessive.

25. United States State Privacy Rights

Residents of California and of other US states with comprehensive consumer privacy laws, including laws in effect in states such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana, among others, may have rights in relation to their personal information, depending on whether those laws apply to Nascentra. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable state laws, these rights may include the right to know what personal information we collect, use and disclose; the right to access and obtain a copy; the right to correct inaccuracies; the right to delete; and the right to opt out of the sale of personal information, the sharing of personal information for cross-context behavioural advertising, targeted advertising and certain profiling. Nascentra does not sell or share personal information, as those terms are defined in the CCPA/CPRA, does not engage in targeted advertising, and has not done so in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16 years of age. Nascentra does not collect sensitive personal information, such as precise geolocation or biometric information, through the Application, and does not use or disclose sensitive personal information for purposes that would require offering a right to limit. We will not discriminate against you for exercising any privacy right, including by denying the Application, charging different prices or providing a different level of quality. You or an authorised agent may submit requests using the contact details below, and you may appeal any decision we make on your request.

26. Privacy Rights in Canada, Brazil, Pakistan and India

We design our practices to respect the privacy laws of other countries where the Application is available. In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25, give you rights to access and correct your personal information, to withdraw consent, and, in Quebec, to data portability and to be informed of the use of technologies that identify, locate or profile you; the Application does not use such technologies for those purposes. In Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you rights to confirmation of processing, access, correction, anonymisation, blocking or deletion, portability, information about sharing, and revocation of consent, and to petition the Autoridade Nacional de Proteção de Dados (ANPD). In Pakistan, we respect the Prevention of Electronic Crimes Act 2016 (PECA) and the related legal framework, which prohibits unauthorised access to information systems and data, unauthorised interception, and misuse of a person’s identity information or images; users must not use the Application, including intruder detection and Vault-to-Vault sharing, in a manner that contravenes it. In India, the Digital Personal Data Protection Act 2023 grants Data Principals rights to information, correction, completion, erasure, grievance redressal and nomination, and the right to approach the Data Protection Board of India after exhausting our grievance process.

27. Privacy Rights in Asia-Pacific, Africa and the Middle East

Users elsewhere may have further rights. In Singapore, the Personal Data Protection Act 2012 (PDPA) gives you rights to access and correct personal data and to withdraw consent, and you may complain to the Personal Data Protection Commission. In Australia, the Privacy Act 1988 and the Australian Privacy Principles give you rights to access and correct personal information and to complain to the Office of the Australian Information Commissioner. In Japan, the Act on the Protection of Personal Information (APPI) gives you rights to request disclosure, correction, suspension of use and deletion of retained personal data, and to be informed about overseas transfers. In South Korea, the Personal Information Protection Act (PIPA) provides rights to access, correct, delete and suspend processing, and to seek redress from the Personal Information Protection Commission. In South Africa, the Protection of Personal Information Act (POPIA) provides rights of access, correction, deletion and objection, and the right to complain to the Information Regulator. In the People’s Republic of China, the Personal Information Protection Law (PIPL) provides rights to know, decide, restrict, access, copy, correct and delete; the Application is not specifically directed at users in mainland China, and these rights apply where the Application is lawfully available there. In the United Arab Emirates, the Federal Personal Data Protection Law (PDPL) provides rights to information, access, correction, erasure and objection. You may exercise any of these rights by contacting us, and we will respond within the time required by applicable law.

28. Children’s Privacy

KiWi Vault is a general-audience utility and is not directed at children. We do not knowingly collect personal information from children under 13 years of age, and the Application does not collect personal information from any user through its ordinary operation. In the United States, the Children’s Online Privacy Protection Act (COPPA) regulates the online collection of personal information from children under 13; because the Application has no account, no server-side data collection, no advertising and no analytics, it does not collect such information online. In the European Union and the United Kingdom, where consent is relied upon for information society services offered directly to a child, the GDPR and UK GDPR require parental consent below the age of digital consent, which ranges from 13 to 16 depending on the country (13 in the United Kingdom). Nascentra does not rely on consent to process children’s data through the Application, but children below the applicable age should use the Application only with the involvement of a parent or guardian, and only a person of legal age in their jurisdiction may purchase KiWi Vault Premium under the Google Play Terms. If you are a parent or guardian and believe that your child has sent us personal information, for example in a support message, please contact us and we will delete it. Parents should be aware that intruder detection and disguise features may be used in a family setting and should consider the privacy of all household members, including children.

29. Security Measures, Limits and Breach Notification

We apply security measures appropriate to the nature of the Application and the limited data we handle. Within the Application, these measures include storing vault items in sandboxed private storage, hashing credentials and recovery information with salted, iterated PBKDF2, encrypting security settings with an AES-256 key held in the Android Keystore, encrypting certain items with AES-256-GCM, disabling Android backup, locking the vault automatically when you leave the Application, and not transmitting vault content off the device. For support communications and order records, we limit access to persons who need it and use reputable providers. No method of storage or transmission is completely secure, and we do not guarantee that the Application or your device cannot be compromised. Your device’s security depends substantially on factors under your control, such as the strength of your device screen lock and vault credential, keeping Android and the Application updated, not rooting the device, not installing untrusted software, and controlling physical access to the device. Because Nascentra does not hold your vault content, a security incident affecting Nascentra would not expose that content. If we become aware of a personal data breach affecting information we process, such as support correspondence, we will assess it promptly and notify the competent supervisory authority and affected individuals where required by law, including within the time limits set by the GDPR, the UK GDPR, the nFADP, US state breach notification laws and other applicable laws.

We may disclose personal information that we hold where we believe in good faith that disclosure is required by applicable law, regulation, court order, subpoena or other legally binding process, or is necessary to protect the rights, property or safety of Nascentra, our users or the public, to detect or prevent fraud or security issues, or to establish, exercise or defend legal claims. We review requests for legal validity and scope, seek to disclose only the minimum information necessary, and, where permitted by law and not counter-productive, will try to notify affected users before disclosure so that they can seek a remedy. Because of how KiWi Vault is designed, the information Nascentra could provide in response to any request is very limited: it is confined to support correspondence and order records made available to us by Google Play. Nascentra does not possess, and therefore cannot disclose, vault content, notes, intruder photographs, credentials, recovery information, usage patterns or any record of Vault-to-Vault transfers, and we have no technical means to unlock or access a user’s vault on a device. We have not built, and do not intend to build, any mechanism that would allow us or others to bypass a user’s vault lock. If a business transaction such as a merger, acquisition or sale of assets occurs, information we hold may be transferred to a successor that agrees to protect it in a manner consistent with this Policy, and we will provide notice where required.

31. Google Play User Data Policy and Data Safety

KiWi Vault is distributed through Google Play, and we design our practices to respect Google Play’s Developer Program Policies, including the User Data policy, the permissions and APIs that access sensitive information policy, and the policy governing all-files access. In line with those policies, the Application requests sensitive permissions only for the features described in this Policy, explains their purpose, and does not use data obtained through them for any undisclosed purpose, for advertising or for sale. The Application does not access personal and sensitive user data beyond what is needed for features you use, and it handles such data on the device. The Google Play Data safety section for KiWi Vault reflects the practices described in this Policy: the Application does not collect user data for transmission to the developer and does not share user data with third parties, as those terms are defined by Google, except to the extent that Google Play services and Google Play Billing process information under Google’s own responsibility. Data that is processed only on your device, such as vault items, notes, intruder photographs and usage patterns, is not considered collected under Google’s definitions. If our practices change, we will update this Policy and the Data safety section together. If you believe the Application handles data in a way that is inconsistent with this Policy or with Google Play’s policies, please contact us so that we can investigate and, where appropriate, correct the issue promptly.

32. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the Application, to our practices, to the services we rely on, or to applicable law. When we make changes, we will revise the Effective Date at the top of this Policy and publish the updated version on our website and, where applicable, through the Application’s Google Play listing. If a change materially affects how personal data is handled, for example the introduction of a new feature that transmits information off your device or a new category of third-party recipient, we will provide more prominent notice, such as an in-app message, before the change takes effect, and we will seek your consent where the law requires it. We will not apply a material change retroactively to personal data collected under a previous version of this Policy without your consent where such consent is legally required. Earlier versions of the Policy may be made available on request. We encourage you to review this Policy periodically. Your continued use of the Application after an updated Policy takes effect means that the updated Policy applies to your use, without prejudice to any right you have under mandatory law to object to or withdraw from processing. This Policy is governed by the laws applicable at the principal place of business of Nascentra Labs, without regard to conflict-of-law rules, while consumers keep the protection of the mandatory laws of their country of residence. If any translation of this Policy conflicts with the English version, the English version prevails to the extent permitted by law.

33. Contact Us and Complaints

If you have questions about this Privacy Policy, wish to exercise any of your rights, or want to make a complaint about how we handle personal data, please contact Nascentra Labs by email at nascentra@gmail.com, by WhatsApp at +923477419855, or through our contact page at nascentra.com/contact. Please include enough information for us to understand your request and, where you are asking about information we hold, to locate it, such as the email address or telephone number you used to contact us or, for purchase matters, your Google Play order identifier. To protect your privacy, we may need to verify your identity before acting on a request, and we will ask only for information necessary for that purpose. If you use an authorised agent, we may ask for proof of the agent’s authority. We will acknowledge your request promptly and respond within the time required by the law applicable to you; where our response is a refusal, we will explain our reasons and tell you how to appeal or complain. This contact point also serves as our grievance mechanism for the purposes of India’s DPDP Act and comparable laws. If you are not satisfied with our response, you may lodge a complaint with the data protection authority in your country or region, such as an EU supervisory authority, the UK Information Commissioner’s Office, the Swiss Federal Data Protection and Information Commissioner, a US state attorney general or privacy agency, or any other competent regulator. We would, however, appreciate the opportunity to address your concern first.

Questions? nascentra@gmail.com