Last updated: August 2026
We cannot see your data. We do not want to. This is not a marketing claim. It is an architectural fact.
All your vault data (passwords, secrets, notes, files, auth codes) is encrypted with AES-256-GCM using a key derived from your master password via PBKDF2-SHA256 (600,000 iterations). The encrypted database is stored locally on your device using expo-sqlite with per-item AES-256-GCM encryption.
Your master password is never stored anywhere. Not on your device, not on any server, not in any log.
Almost nothing, and never the contents of your vault in a form we can read. The app contacts our servers in three cases: the Whisper feature, cloud sync if you turn it on (see below), and a version check on launch. The version check sends only the app version, so we can warn you if a release needs replacing urgently; it carries no identifier and no vault data, and if it fails for any reason the app carries on normally. For Whisper:
The Lockbox apps and browser extension contain no analytics. This website does: we run a self-hosted Umami instance to count page views. It is cookie-less, records no personal data, does not track you across sites, and is never loaded on the Whisper page where a secret could appear in the URL. It tells us how many people visited, nothing about who they are.
Cloud sync is off unless you turn it on. When enabled, your data is encrypted on your device before it is uploaded, and the encrypted blobs are stored on servers we operate. The encryption key is derived from your sync passphrase, which never leaves your devices, so we cannot read your synced data. We only ever hold opaque encrypted blobs.
To be precise about what our server can see: an anonymous account identifier derived from your passphrase, a per-device identifier, item identifiers, and the time each item last changed. It cannot see titles, usernames, passwords, notes, or any item contents.
Lockbox does not integrate with any third-party analytics, advertising, or tracking services. The only external service is the Whisper relay, which is operated by us on our own infrastructure.
Uninstall the app and all local data is gone. If you used cloud sync, open Settings and choose Delete cloud data to permanently remove your encrypted copy from our servers. If you used the Dead Man's Switch, the app automatically deletes all data after your configured inactivity period.
All encryption is done with proven, widely audited open-source libraries (@noble/ciphers and @noble/hashes) rather than hand-rolled cryptography. Our own encryption module is not yet published; when it is, it will be linked here. We would rather say that plainly than imply an inspection you cannot actually perform.
Questions about privacy? Email privacy@lockboxnow.app