CipherBox Privacy Policy

Last updated: 16 August 2026

CipherBox is a file-encryption app for Android. It encrypts your files on your device and stores them so that only you can open them. This policy explains exactly what the app accesses, what leaves your device, and what does not.

The short version. CipherBox has no servers and no accounts of its own. It collects no analytics, contains no advertising, and no usage data is transmitted anywhere. Your files are encrypted on your device with a key derived from your master password. That password and the encryption keys never leave your device, and are never sent to us or to anyone else. If you choose to back up to Google Drive, only already-encrypted files are uploaded.

Who this policy is from

[YOUR NAME OR COMPANY] ("we") publishes CipherBox. Contact us about privacy at you@example.com.

What the app accesses, and why

Permission or data	Why	Where it goes
Camera	To take photos inside the app. Each photo is encrypted immediately after capture, and the temporary unencrypted file is overwritten and deleted.	Stays on your device. Photos taken in CipherBox are never added to your camera roll and are not visible to other apps.
Photos and videos (`READ_MEDIA_IMAGES`, `READ_MEDIA_VIDEO`)	To read the items you select so they can be encrypted into your vault. Access to your gallery is also what allows CipherBox to offer to delete the original after encrypting it — the system photo picker returns a copy with no link to the original, which makes deletion impossible.	Stays on your device. Only items you explicitly select are read. Deleting an original always requires confirmation through Android's own dialog.
Files you choose	To encrypt documents you pick with the system file picker.	Stays on your device. The temporary copy the picker provides is overwritten and deleted after encryption.
Google account (name, email address, account identifier)	Only to identify which Google Drive account your backups go to. Signing in is optional — CipherBox works fully without it, just without backup.	Stored on your device so the app remembers which account you chose. Not transmitted to us. We operate no servers and never receive it.
Google Drive (`drive.file` scope)	To upload encrypted backups, if you turn backup on.	To your own Google Drive. See the section below for exactly what is uploaded.
Internet	Used solely for Google sign-in and Drive backup.	Google only. CipherBox contacts no other network service.

What we collect about you

Nothing. CipherBox has no analytics, no crash reporting, no advertising identifiers, no tracking, and no backend of any kind. We cannot see your files, your filenames, how you use the app, or whether you use it at all.

What is uploaded when you enable Google Drive backup

Backup is optional and off until you sign in. When enabled, CipherBox creates a folder named CipherBox in your Google Drive and uploads:

Your files, encrypted. Each is uploaded as an encrypted container with a randomly generated filename. The file contents, the original filename, and the file type are all encrypted inside it. Google cannot read them, and neither can we, and neither can anyone who gains access to your Google account.
Your folder names, readable. If you organise files into folders, that folder structure is mirrored in Drive using the folder names you chose, so that your backup is browsable. This means your folder names — but not your file names or file contents — are visible to Google and to anyone with access to your Drive account.

The drive.file permission grants CipherBox access only to files it creates itself. CipherBox cannot see, read, or modify anything else in your Google Drive.

Your master password, your encryption keys, and the list of what is in your vault are never uploaded.

Encryption

Files are encrypted on your device using AES-256-GCM. The key is derived from your master password using Argon2id. Neither your password nor any key derived from it is ever transmitted or stored anywhere outside your device.

There is no password recovery. Because we never receive your password or your keys, we cannot reset your password or recover your files if you forget it. This is a deliberate consequence of the app not being able to read your data. Nobody can restore access for you.

Retention and deletion

On your device: data stays until you delete it. Deleting an item or folder in the app removes it permanently. Uninstalling CipherBox removes the app's entire vault, and it cannot be recovered afterwards.
In Google Drive: delete the CipherBox folder in Drive to remove your backups. You can also revoke the app's access entirely at myaccount.google.com/permissions.
With us: nothing, because we never hold any of your data.

Sharing

We do not sell, share, or transfer your data to anyone, because we do not have it. The only third party involved is Google, and only for the sign-in and Drive storage you explicitly enable. Their handling of that data is governed by the Google Privacy Policy.

Children

CipherBox is not directed at children under 13 and we do not knowingly collect any information from them. Since we collect nothing from anyone, no such data can exist.

Your rights

Privacy laws including the GDPR and CCPA give you rights to access, correct, export, and delete personal data held about you. Because we hold none, these rights are satisfied directly: all of your data is on your own device and in your own Google account, entirely under your control. Contact us at the address above with any questions.

Changes

If this policy changes, the updated version will be posted at this URL with a new date at the top. Material changes affecting how your data is handled will also be noted in the app.