Privacy Policy

• Local vault: vault contents are stored in an encrypted database on your device.
• No routine vault upload: Aranor does not send us your vault, master password, recovery code, biometric data, clipboard contents, or autofill contents.
• No advertising profile: we do not use advertising SDKs, sell personal data, or use vault data for advertising, profiling, or AI model training.
• No usage tracking unless you turn it on: usage statistics are off unless you switch on "Share usage stats". See section 2.
• User-directed transfers: exports, transfers, and backups go only to a destination you initiate or configure.
• No back door: because we do not possess your master password or vault key, we generally cannot unlock, reset, recover, or decrypt your vault.

"Local-first" does not mean no network connections. Updates, diagnostics, integrity checks, breach information, purchase verification, and optional cloud features may require limited network processing.

Depending on the version and features used, we or our providers may process:

• Support data: your email, message, attachments, and anything you choose to send. Never send a master password, recovery code, or unredacted vault export.
• Diagnostics: crash time and trace, app version, device model, OS version, language, memory or storage state, root status, and random installation, crash, or session identifiers. Aranor is designed not to place vault fields in logs.
• Usage statistics — optional, off unless you turn them on: if you switch on "Share usage stats" when you create your vault or later in Settings › Privacy, the app sends Google Analytics for Firebase short records of which screens and features are used and whether certain steps worked — for example, that a vault was set up, that a backup failed because the Drive account was full, or which screen a Premium purchase started from. Google Analytics also adds a few standard records of its own: when the app is first opened or updated, how long it is used, and, if you buy Premium through Google Play, the plan bought with its price and currency. Each record carries a random identifier created for this installation of the app, the app version, device model, Android version, language, and an approximate country that Google works out from the connection. It never contains vault contents, passwords, website or app names you have saved, anything you type, your name, email address, Google account, or advertising ID. Nothing is collected while the app is locked, in a decoy vault, or in travel mode.
• Service and security metadata: IP address, user agent, request time, app/package version, integrity or attestation results, and anti-abuse signals.
• If you buy Premium (Firebase Authentication and Cloud Firestore, run by Google):
  • A sign-in account created when you choose a Google account at purchase or restore. It holds what Google sign-in provides (your Google account's name, email address, profile-photo link and a user ID) and sign-in timestamps. Aranor does not show or use the name or photo; Google sign-in supplies them and they are deleted with the account.
  • One Premium record for that account: your plan (monthly or yearly), whether it is active, in a grace period or cancelled, whether it renews, the date your paid time ends, a scheduled deletion date if you chose one, and a one-way fingerprint (SHA-256 hash) of the Google Play purchase token. The purchase token itself is never stored.
  • A table linking each purchase fingerprint to the account that owns it, so one purchase cannot unlock Premium for two accounts.
  Google Play processes payment details; we do not receive your full card number.
• App configuration (Firebase Remote Config and App Check): the app fetches settings and proves it is a genuine copy of Aranor. These carry an app-instance identifier, not your identity.
• QR code scanning (Google ML Kit): the camera image is read on your device and never leaves it. ML Kit sends Google usage and performance diagnostics — not the image, and not what the code contained.
• Breach news (Premium): the app downloads a public list of published breaches. Nothing about you is sent to fetch it.

Usage statistics are the only product analytics in Aranor, and they are off unless you turn them on. Turning them off stops collection, deletes the identifier and any records not yet sent from your device, and means later use cannot be linked to earlier records.

The following is designed to remain on your device: vault entries, usernames, passwords, URLs, secure notes, one-time-password seeds, master passwords, recovery materials, encryption keys, biometric results, decoy-vault information, clipboard and autofill contents, installed-app associations, and local security-health data.

Android or another app may observe data through features outside our control, such as a keyboard, accessibility service, clipboard manager, screen capture, rooted device, or compromised operating system.

Crash reporting

Aranor uses Firebase Crashlytics to diagnose failures. Google may process crash traces, installation/session identifiers, and device, app, and network metadata. Firebase states that crash traces and associated identifiers are retained for 90 days before deletion begins. Unexpected system-supplied exception text can enter reports, so avoid secrets in externally visible file names.

Usage statistics

Only if you have switched them on, Aranor uses Google Analytics for Firebase to count which screens and features are used and where steps fail, so we can fix what goes wrong and see which features matter. We have turned off advertising ID collection, ad personalisation, Google signals and data sharing with other Google products, and Aranor sets no user ID. Google receives the connection's IP address in order to deliver the records. Because the records are not linked to your name, email or account, we generally cannot find a particular person's records; the switch is how you stop and reset collection.

Password exposure checks

For an online Pwned Passwords check, Aranor hashes the candidate password on-device and sends only a short hash prefix in a k-anonymity range query to Have I Been Pwned (HIBP). Your password and complete hash are not sent. HIBP receives the IP address and prefix and returns many matching suffixes; comparison occurs on-device. Local typing-time checks do not send the password.

Public breach data, updates, and configuration

The app may retrieve public breach information, app updates, minimum-version settings, or non-user-specific configuration from HIBP, Firebase, Google Play, or MurvianLabs infrastructure. Providers receive ordinary network metadata; requests are not intended to contain vault-derived information.

Backups and Google Drive

If you export a backup or connect Drive, Aranor creates an encrypted backup and sends it to the location you choose. Drive backup (Premium) requests access only to files Aranor creates—not unrelated Drive files, email, contacts, or profile data. Tokens and destination IDs are used only for the requested backup. Google API data is handled under the Google API Services User Data Policy, including Limited Use.

Purchases

When you buy Premium, Google Play handles checkout and gives us the purchase and subscription state needed to provide it. Google independently handles payment and account data under its own policy.

Aranor may request access in context for a feature you choose:

• Autofill to fill credentials after your approval.
• Biometrics/device credential: Android reports success or failure; Aranor does not receive your face or fingerprint template.
• Camera to scan transfer or one-time-password QR codes; frames are processed for that action and not sent to us.
• Notifications for enabled security, update, backup, or recovery reminders.
• Selected files/folders through Android system pickers for imports, exports, and backups.
• Installed-app visibility, where permitted, to associate logins for autofill. The inventory is processed locally and is not sent to us.

You can revoke permissions in Android settings, but the related feature may stop working.

• Contract: provide requested features, purchases, entitlements, support, and updates.
• Legitimate interests: secure and improve reliability, diagnose crashes, prevent abuse, protect users, and establish or defend claims, where not overridden by your rights.
• Consent: usage statistics, optional permissions, third-party connections, or where law requires it. You may withdraw consent at any time; for usage statistics, turn off "Share usage stats" in Settings › Privacy.
• Legal obligation: comply with law, valid process, and tax/accounting duties.

Under India's Digital Personal Data Protection Act, we process digital personal data for a lawful purpose with consent or another use permitted by law. Under GDPR/UK GDPR, our bases generally correspond to contract, legitimate interests, consent, and legal obligation.

We do not sell personal data or share it for cross-context behavioural advertising. We may disclose limited data:

• to Google/Firebase for hosting, Crashlytics, optional usage statistics (Google Analytics for Firebase), integrity, configuration, authentication or backend infrastructure; Google Play for distribution and billing; and support providers we engage;
• at your direction to a backup location, Drive account, receiving device, or destination you select;
• where reasonably necessary for law, valid process, safety, fraud prevention, rights protection, or legal claims; and
• in a merger, financing, acquisition, reorganisation, or asset sale, subject to confidentiality and this Policy.

See Firebase Privacy and Security for its current processing practices. MurvianLabs Private Limited is incorporated in India, while providers operate globally. Data may be processed in India, the United States, and other provider locations. Where required, we use lawful safeguards such as adequacy mechanisms or standard contractual clauses.

• Vault data: remains on-device until you delete it, erase app data, uninstall, or use the in-app wipe. Android backup behaviour may vary.
• Your backups: remain at the chosen destination until you or its provider deletes them. Uninstalling Aranor may not delete external copies.
• Entitlements: retained while needed for paid service, refunds/disputes, and legal, tax, accounting, or fraud-prevention duties, then deleted or de-identified.
• Support: ordinarily retained up to 24 months after resolution unless security, law, or an ongoing relationship requires longer.
• Crash data: Firebase states Crashlytics data is kept for 90 days before removal begins.
• Usage statistics: event-level records are kept for two months in Google Analytics and then deleted. Aggregated reports that do not identify an installation may be kept longer.

Deletion from backups can lag deletion from live systems. We may retain minimal records needed to prove compliance, honour an opt-out, prevent fraud, or meet law.

Aranor uses safeguards appropriate to a password manager, including authenticated vault encryption, password-based key derivation, Android Keystore-backed protection where available, encrypted network transport, least-privilege access, release hardening, and controls intended to keep secrets out of logs. Access to service data is limited on a need-to-know basis.

No system is perfectly secure. Device compromise, malware, a weak master password, an unlocked session, screen capture, malicious keyboard/accessibility software, rooting, or lost recovery material can defeat protection. Secure your device, choose a strong unique master password, protect recovery material, maintain tested backups, and install updates.

If we confirm a breach affecting data for which we are responsible, we will contain and assess it, preserve appropriate evidence, notify regulators and people when required, and explain material risks and protective steps without unreasonable delay. Because we do not possess your vault key, compromise of our systems should not by itself reveal a locally held vault.

Subject to your location and legal exceptions, you may have rights to access or know about data; receive a copy; correct, complete, update, or delete it; withdraw consent; object or restrict processing; request portability; nominate another person where Indian law provides; appeal; complain to the Data Protection Board of India or another competent regulator; and receive equal service without unlawful discrimination.

You may opt out of sale, targeted advertising, or covered profiling; we do not currently conduct those activities. Use Aranor's erase function or Android controls for local data. We cannot access or delete data that exists only on your device or at a destination you control. Direct provider-held-data requests to that provider.

Deleting your Premium account: in the app, open Settings › Aranor Premium › Delete account. Once Premium has ended, Delete account is behind the settings (gear) icon on that screen. You choose one of two ways:

• Delete when Premium ends. Renewal is cancelled now, Premium keeps working until the end of the time you have paid for, and then your sign-in account and Premium record are deleted automatically. You can undo this in the app until that date, though renewal must then be turned back on in Google Play.
• Delete everything now. Renewal is cancelled and your sign-in account and Premium record are deleted immediately. Any paid time left is lost.

Deleting your account never touches the vault on your phone or backups in your Google Drive — delete those yourself if you want them gone. If you no longer have the app, see murvianlabs.com/aranor/delete-account or email us from the Google account you used with Aranor. The purchase fingerprint described in section 2 is kept with the link to your account removed; it cannot identify you, and it stops a deleted purchase being claimed again by another account.

Use section 11's contact method to make a request. We may verify identity and an agent's authority and will respond within the legally required period. Raise a grievance with us first, then use the regulator or appeal route available to you if it remains unresolved.

Aranor is a general-audience security utility and is not directed to children. Anyone below the applicable age of digital consent or contractual capacity must use it only with verifiable consent and supervision from a parent or lawful guardian. We do not knowingly track children or use their data for behavioural advertising or harmful processing. A guardian may request deletion of data supplied to us.

We may update this Policy as the Service, providers, or law changes. We will post the revised version and date here. For material changes, we will provide additional in-app, website, store, or other reasonable notice where required, and request fresh consent before a materially different use when law requires.

MurvianLabs Private Limited, a company incorporated in India, is Aranor's developer and operator. For privacy questions, rights requests, security reports, or grievances, email contact@murvianlabs.com. Put "Aranor Privacy" in the subject and state the request and your country/state. Do not include vault secrets, master passwords, recovery codes, or unredacted vault exports in your message.

Email is the designated channel for grievance redressal under India's Digital Personal Data Protection Act and for data-subject requests under the GDPR/UK GDPR and comparable laws. We acknowledge requests and address grievances within the period required by law. The verified legal name, postal address, and telephone number of the developer are additionally displayed on Aranor's Google Play listing where required and form part of this contact notice.