Privacy Policy

Last updated: 24 July 2026

Kavach collects nothing. Your data stays on your device, encrypted. We run no servers, have no user accounts, use no analytics, and have no way to see anything you store.

Who this applies to

This policy covers the Kavach Android application (package app.codewalker.kavach), published by The Codewalker.

What Kavach stores, and where

Everything you save in Kavach — passwords, cards, documents, and files — is stored only on your device, inside an AES-256 encrypted SQLCipher database. The encryption key is derived from your Master Password / PIN using Argon2id and is never stored anywhere. If you lose your credentials, the data is unrecoverable — because we never held it.

What we collect

Nothing. Kavach has:

• No user accounts and no sign-up
• No analytics or telemetry of any kind
• No crash-reporting or advertising SDKs
• No servers operated by us — the app works fully offline

Google Drive backup (optional) and use of Google user data

If you choose to enable backup, Kavach uses Google Sign-In and requests a single, narrow scope:

• https://www.googleapis.com/auth/drive.appdata — access to Kavach's own private application-data folder in your Google Drive. This does not grant access to any other file in your Drive.

How that access is used:

• Kavach encrypts your vault on-device with AES-256-GCM (key derived from a backup password only you know) and uploads the encrypted file to that private folder.
• The data is used solely to store and restore your own backup. It is never transmitted to us, never shared with third parties, and never used for advertising, profiling, or any other purpose.
• Kavach never sees or stores your Google account password; authentication is performed by Google.
• You can disconnect Google Drive and delete the backup from within the app at any time.

Kavach's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Breach scan (optional)

The optional breach scan checks passwords against the Have I Been Pwned database using k-anonymity: only the first 5 characters of a one-way SHA-1 hash ever leave your device. Your actual passwords are never transmitted.

Purchases

The optional Kavach Pro upgrade is processed entirely by Google Play Billing. We receive no payment details.

Permissions

• Camera — only to scan 2FA QR codes; images never leave the device.
• Biometrics — handled by Android; Kavach never accesses fingerprint or face data.
• Internet — used only for the optional Drive backup and breach scan.

Data retention & deletion

Because we hold no data, there is nothing for us to retain or delete. Your on-device data is removed when you delete items in the app or uninstall Kavach. Any Google Drive backup can be deleted from within the app or from your Google account.

Children

Kavach is not directed at children under 18.

Changes

If this policy changes, the update will be posted at this URL with a new date. Since we collect nothing, changes can only make that promise more specific — never weaker.

Contact

Questions: thecodewalker.dev@gmail.com