Nothing to collect.
Summary
LocalKeep is an offline, local-first password manager for Android. The app never sends your vault anywhere. There is no LocalKeep server that receives your data, and no account. We do not collect, sell or share your personal data, and there are no analytics, no ads and no tracking.
One exception, and it belongs to the operating system, not to us. If you leave Android's own Auto Backup on for LocalKeep, Android may copy your encrypted vault file to your Google account, the way it does for any app's data. LocalKeep never initiates that upload and cannot read what Google stores: what travels is the same ciphertext that sits on your phone, and the device-bound key material used for biometric unlock is deliberately excluded from the backup. The app asks you during setup whether you want this, and you can change it at any time in Backup & export (“Include vault in Android backup”).
What we collect through the app
Nothing. LocalKeep has no backend. Your vault — logins, notes, cards, identities, files, passkeys and the rest — is stored encrypted on your device. We never receive it and cannot read it.
- No personal data is collected or processed by us through the app. There is no processing on our side because there is no server.
- No analytics, telemetry or crash reporting that sends data off the device.
- No advertising or tracking identifiers.
Android itself may report a crash to Google if you have the system's diagnostics setting turned on. That is the operating system, not LocalKeep, and such a report never contains vault contents, passwords or keys.
Data on your device
Your encrypted vault, its rolling local snapshots and any files you attach are kept in the app's private storage, protected by a key derived from your master password (Argon2id, with the vault sealed by AES-256-GCM-SIV). Optional biometric unlock uses your device's secure hardware. None of this is transmitted anywhere by us.
If Auto Backup is on, only the encrypted vault file is included — your attached files and photos are not, so a restore from Google brings back your items without their files.
Location
LocalKeep can save a place as a vault item. It reads your location only at the moment you tap “Save current location”, stores that single reading in your encrypted vault alongside your other items, and sends it nowhere. There is no tracking, no history of where you have been, no background access and no map lookup.
The permission is requested at that tap, never at launch. If you decline, everything else in the app keeps working; you simply cannot create that kind of item. You can revoke location access at any time in Android's settings, and locations you have already saved stay in your vault.
Camera
The camera is used only when you choose to scan a two-factor QR code or take a photo into your vault. Scanning happens on the device, and what you capture is stored in your encrypted vault. Nothing is sent anywhere.
Network access
- The Google Play build has internet access only for Google Play Billing (the one-time Pro purchase and checking that it is still valid) and Google Play's occasional in-app review card. No vault data, password or file is ever sent over the network. Purchases and reviews are handled by Google under Google's own privacy policy.
- The open-source build distributed outside Google Play has no internet permission at all and cannot make network requests itself.
In both builds, Android's Auto Backup (above) is performed by the operating system, not by LocalKeep, which is why it is possible even in the build without internet access.
Payments
The optional Pro upgrade is sold and processed by Google Play. We never see your card or payment details. Google may share order details with us that we need to manage the purchase, such as an order number; see Google's privacy policy for how Google processes payments.
If you contact us
If you email support@localkeep.app, we receive your email address and whatever you write, and use them only to answer you. Never send us your master password, Recovery Kit words or vault contents — we do not need them and cannot use them. We keep support correspondence only as long as needed to handle your request, and you can ask us to delete it at any time.
This website
localkeep.app sets no cookies, runs no analytics and loads nothing from third parties: fonts and scripts are served from this site itself. It is hosted on Amazon Web Services (Amazon CloudFront), which necessarily receives your IP address and the page you request in order to deliver it. We have not enabled access logging for this site.
Your rights (GDPR)
Because we hold none of your app data, there is nothing for us to access, correct or erase — you control it directly on your device: you can export, back up or delete your vault at any time from within the app. Uninstalling the app removes the vault from the device; a copy made by Android's Auto Backup is managed in your Google account. For anything we do hold, such as an email you sent us, you have the rights of access, rectification, erasure, restriction, objection and portability — write to us at the address above. You also have the right to lodge a complaint with a supervisory authority; in Bulgaria that is the Commission for Personal Data Protection.
Children
LocalKeep is not directed at children and collects no data from anyone.
Changes
If this policy changes we will update this page and its effective date. Material changes will also be noted in the app's release notes.