Privacy Policy

Last updated: April 13, 2026  |  Version 1.0

Who we are

AstraVault is a privacy-first document management application developed by AstraSoft. We do not operate any servers. Your documents are stored encrypted in your own Google Drive account.

What data we collect

Required for the app to work

Data	Why	Where stored
Google Account (Gmail)	To sign you in and link your Google Drive	Encrypted on your device
Google Drive access	To store your encrypted documents	Your own Google Drive

Optional — your choice

Data	Why	Default	Where sent
Crash reports	To fix bugs	OFF	Firebase Crashlytics (Google)
App usage analytics	To improve the app	OFF	Firebase Analytics (Google)

Never collected

• We never collect document content
• We never read your files
• We never see your Aadhaar, PAN, or any personal documents
• We never sell or share your data for advertising

How we protect your data

• AES-256-GCM encryption — Every document is encrypted before it leaves your phone
• Hardware-backed keys — Your encryption key is stored in your phone's secure hardware (TEE/StrongBox)
• SQLCipher database — All metadata is encrypted with PBKDF2-HMAC-SHA256 key derivation (310,000 iterations)
• TLS 1.3 — All network communication uses the strongest available encryption
• Certificate pinning — We verify Google's servers before sending any data
• SHA-256 integrity — Every upload is verified with a constant-time hash comparison after completion

Your rights under DPDP Act 2023

Section 11 — Right of Access

You can download all your data at any time from Settings → My Data Rights → Access my data. Your documents are already in your Google Drive.

Section 12 — Right to Correction

Request a correction by emailing info@astravault.co.in. We will resolve your request within 7 calendar days.

Section 13 — Right to Erasure

Delete your account from Settings → Delete My Account. A 30-day cooling period applies — you can cancel anytime within that period. After 30 days, all data is permanently and irreversibly deleted.

Section 14 — Grievance Redressal

File a grievance in-app or by emailing info@astravault.co.in. We respond within 7 calendar days. If unsatisfied after our response, you may escalate to the Data Protection Board of India within 90 days.

Right to Withdraw Consent

You can change your optional consent choices at any time in Settings → Consent Manager. Withdrawal takes effect immediately. Required data processing (Google Account + Drive) cannot be withdrawn as it is essential for the app to function.

Right to Nominate

You can nominate a person to exercise your data rights in case of death or incapacity, as provided under the DPDP Act 2023.

Children's data

AstraVault requires users to be 18 years or older. Users under 18 require verifiable parental consent as mandated by the DPDP Act 2023.

Data retention

• Your documents: Stored as long as you keep them. Deleted when you delete them.
• Crash reports: 90 days (Firebase Crashlytics retention policy)
• Consent records: Retained for 5 years (DPDP compliance requirement)

Third-party services

Service	Purpose	Privacy Policy
Google Drive	Document storage	Google Privacy Policy
Firebase Auth	Sign-in	Firebase Privacy
Firebase Crashlytics	Crash reporting (opt-in)	Firebase Privacy
Google Play Billing	In-app purchases	Play Privacy

Changes to this policy

We will notify you of significant changes via push notification and in-app banner. Your continued use of the app after notification constitutes acceptance of the updated policy.

Contact