Security
How My NoteVault encryption works
A plain account of how My NoteVault protects your vault, what leaves your phone and what it cannot do. Accurate as of version 3.4.0, September 2026.
How does your password become a key?
When you set a vault password, My NoteVault runs it through PBKDF2-HMAC-SHA256 with 100,000 iterations to derive an encryption key on your phone. Every vault gets its own key. Your password and your keys are never sent anywhere, and ZeengoCorp never sees them.
- PBKDF2-HMAC-SHA256, 100,000 iterations
- A separate key for every vault
- Made on the phone, never uploaded
What do AES-256 and SQLCipher protect?
Your vault files (photos, videos, audio and documents) are encrypted with AES-256. The vault databases that hold file names, folders, thumbnails and the file index are encrypted with SQLCipher. Without your password, what is stored on the phone is unreadable data, not your files.
What leaves your phone?
Your notes and vault files never leave your phone: My NoteVault has no accounts and no cloud storage, and it opts out of Android's cloud backup. The app does talk to a few services for ads, analytics, crash reports, settings and billing. They receive standard device data, never your notes or files.
| Service | Why the app uses it | What it receives |
|---|---|---|
| Google AdMob, with Meta Audience Network, Unity Ads, Liftoff Monetize and BidMachine | Ads in the notepad and at app start | Advertising ID, IP address, device and ad-interaction data |
| Firebase Analytics | Counting how features are used | App events (for example, that a vault was unlocked by fingerprint), an app instance ID and device data |
| Firebase Crashlytics | Fixing crashes | Crash traces, app version and device model |
| Firebase Remote Config and Cloud Messaging | App settings and notifications | An app instance ID and a push token |
| Firebase App Check with Google Play Integrity | Blocking tampered copies of the app | Short-lived integrity tokens |
| Google Play or Samsung billing | Premium subscriptions | A purchase confirmation; the store handles payment |
Details, retention periods and your rights are in the privacy policy.
What My NoteVault cannot do
My NoteVault cannot recover a forgotten password: the key is made from it on your phone and we never have a copy. Uninstalling the app deletes your vaults, because they live in its private storage. And encryption cannot help while your phone is unlocked, with the vault open, in someone else's hands.
- No password reset by the company, by design
- Back up or move files before uninstalling
- Close the vault before you hand your phone to someone
How do recovery kits work?
When you create a vault you get a recovery code and a recovery kit. Store them off the phone, on paper or somewhere else you trust. The code lets you back into the vault if you forget your password. Treat it like a spare key: anyone holding it and your phone can open that vault.
How are encrypted transfers protected?
Each encrypted transfer file uses a fresh key. Every file inside is authenticated with HMAC-SHA256, so tampering is detected when the transfer is opened, and file names are hidden inside an encrypted manifest. You can store or send a transfer file through any app without exposing what is in it.
What does My NoteVault protect against?
My NoteVault protects your files against a phone falling into the wrong hands: an unlocked phone picked up and browsed, a notepad searched without the secret word, or a locked phone taken and inspected while off. It cannot protect against everything — some risks sit outside what any app on the device can do.
What it protects against
- Someone picking up your unlocked phone and scrolling your gallery or files
- Someone browsing the notepad without knowing your secret word
- A lost or stolen phone that stays locked: vault files are AES-256 and the databases are SQLCipher, with the key derived from your password
- Someone who copies the app's files off the device without your password
What no vault app can protect against, including this one
- An unlocked phone with the vault already open, handed to someone else
- Being compelled to unlock your phone or vault
- Malware, or a compromised or rooted device
- Screenshots or screen recording while you're viewing a file
- Copies of a file that already exist elsewhere: a cloud backup made before hiding it, a chat app, another device
Key points
- Vault files: AES-256
- Vault databases: SQLCipher
- Keys: PBKDF2-HMAC-SHA256 with 100,000 iterations, one per vault
- No accounts, no cloud copy, no Android cloud backup
- No password recovery by the company: keep your recovery code safe
Last reviewed