Last updated: March 2026
We cannot see your data. We do not want to. This is not a marketing claim. It is an architectural fact.
All your vault data (passwords, secrets, notes, files, auth codes) is encrypted with AES-256-GCM using a key derived from your master password via PBKDF2-SHA256 (600,000 iterations). The encrypted database is stored locally on your device using expo-sqlite with per-item AES-256-GCM encryption.
Your master password is never stored anywhere. Not on your device, not on any server, not in any log.
Almost nothing. The app talks to our servers in two cases only: the Whisper feature, and cloud sync if you turn it on (see below). For Whisper:
The Lockbox apps and browser extension contain no analytics. This website does: we run a self-hosted Umami instance to count page views. It is cookie-less, records no personal data, does not track you across sites, and is never loaded on the Whisper page where a secret could appear in the URL. It tells us how many people visited, nothing about who they are.
Cloud sync is off unless you turn it on. When enabled, your data is encrypted on your device before it is uploaded, and the encrypted blobs are stored on servers we operate. The encryption key is derived from your sync passphrase, which never leaves your devices, so we cannot read your synced data. We only ever hold opaque encrypted blobs.
To be precise about what our server can see: an anonymous account identifier derived from your passphrase, a per-device identifier, item identifiers, and the time each item last changed. It cannot see titles, usernames, passwords, notes, or any item contents.
Lockbox does not integrate with any third-party analytics, advertising, or tracking services. The only external service is the Whisper relay, which is operated by us on our own infrastructure.
Uninstall the app and all local data is gone. If you used cloud sync, open Settings and choose Delete cloud data to permanently remove your encrypted copy from our servers. If you used the Dead Man's Switch, the app automatically deletes all data after your configured inactivity period.
Our encryption module is open source. You can inspect exactly how your data is encrypted, what keys are derived, and verify that no data leaks occur.
Questions about privacy? Email privacy@lockboxnow.app