Vault-ZIP privacy

Last updated: November 8, 2026

This page explains how Vault-ZIP (Windows, Linux, the command-line tool and Android) handles information. As our privacy policy provides, this page takes precedence for Vault-ZIP.

1. What is not sent

Vault-ZIP never sends your files, passwords or ledger anywhere without your action. We run no servers and there is no account. Vault-ZIP contains no analytics, advertising or tracking tools, and does not check for updates by itself. Page views and download counts on this website and the download server are counted without cookies and without tracking individuals (section 6 of the privacy policy); none of this is inside Vault-ZIP.

The Windows version draws its windows with a Microsoft component, WebView2, which can connect to Microsoft's servers on its own. Vault-ZIP opens its windows with that background traffic switched off. WebView2 itself is updated, as for other apps, through Windows and Microsoft Edge updates.

2. What is stored on your PC or device

• The ledger: names, dates, passwords and notes of the ZIP and PDF files you make, stored encrypted. Its key is kept in Windows Credential Manager (on Android, the device keystore). The portable version protects it with a passphrase you choose.
• Settings and a record of the work done.

Data is stored in %APPDATA%\VaultZip (installed version) or inside the portable version's folder.

On Android, the ledger and settings are stored in the app's private area. They are excluded from Android's automatic backup and device-to-device transfer; to move to another device, use the full backup you create yourself. The identity check before the ledger opens (fingerprint, face or screen lock) is done by the Android system, and Vault-ZIP receives no fingerprint or face data.

3. What goes out only when you act

• Links, such as guides on how to open a file, open in your browser.
• If you choose a cloud-synced folder for backups, the encrypted backups are sent to that service.
• When you use mail or share, the app you pick receives the content.
• On Android, a file received from another app through "Share" is copied into the app's area for the time of the work and removed afterwards (a copy of a PDF within a day at the latest). Vault-ZIP reads and writes only the files and folders you choose.
• When you use the install scripts (install.sh, install.ps1), only at the moment you run the command, they fetch the signed list of versions and the file you chose from the download site, and check the signature and SHA-256 before installing. This is not part of the app itself.
• If you enable an external tool (such as 7-Zip) in the settings, files are handed to that tool to extract. Vault-ZIP asks it for no connection.

Besides this, on a PC without the WebView2 Runtime the installer downloads it from Microsoft.

4. Licence check

Licences for organisations are checked on the PC only; nothing is sent.

5. Support purchases (Android)

On Android you can make a purchase from Settings to support development. The purchase is handled by the Google Play app; Vault-ZIP never receives payment details such as card numbers, and only learns that a purchase was completed. Nothing is added or changed by purchasing. We do not use a billing intermediary such as RevenueCat. Purchase records are kept by Google to the extent Google defines.

6. Contact

Toriinthecat [email protected]