Meritwright Vault Mobile Privacy Notice

1. Scope and privacy at a glance

Meritwright LLC provides this notice for the Android and planned iPhone and iPad editions of Meritwright Vault Mobile. The Android edition is in Google Play certification and pending release, not yet publicly available. The initial release is planned for Android through Google Play, with an iPhone and iPad edition planned afterward. The record, attachment, export, and backup functions described below apply to the current Android edition. We will review this notice against the Apple edition before its release.

This notice does not cover Meritwright Vault Desktop or Norivault. The corporate Privacy Policy separately explains Meritwright.com and company email. Apple, Google, device providers, and applications you choose have their own policies.

2. Information kept locally

The Android app stores records you create, including their titles, categories, notes, creation and update dates, and encrypted attachments you select. Records may contain sensitive identity, financial, medical, legal, emergency, or household information. Only add information you are entitled to use.

Vault records and attachments are encrypted in private app storage. The app also keeps local preferences, the accepted terms version, storage-health information, and backup-reminder information. These settings and operating records are not all vault-encrypted. The Android device-bound credential is protected by Android Keystore and is not included in an exported recovery backup.

The app does not send vault contents, filenames, notes, attachments, passphrases, encryption keys, device credentials, backup contents, accepted-terms records, or usage behavior to Meritwright.

3. Local processing and protected access

Information is processed on your device to organize, search, display, edit, encrypt, export, or delete the records you choose. Information needed for those actions is readable in the app while the vault is unlocked. Meritwright does not remotely scan your records or receive automated app analytics or crash reports from the app.

The Android app does not request internet permission, location, camera, microphone, contacts, or broad storage access. It uses the operating system's file picker for files and destinations you select. Another file provider may use network access independently to make a selected file or destination available.

The Android vault requires its passphrase and device-bound credential. When a supported strong biometric is enrolled and available, biometric verification is also required for vault access. Biometric lockout or an enrollment change is not permission to bypass that requirement. The app uses operating-system authentication results, not a stored copy of your fingerprint or face.

The planned Apple edition's access design uses iOS Keychain protection. Its completed vault behavior and final permissions will be reviewed before release. This notice does not imply that Apple record storage or backup features are already available.

4. User-selected files and services

The Android app reads an external file only after you select it for import or restoration. Importing an attachment creates an encrypted local copy and does not remove or protect the original file.

Exporting an attachment creates a decrypted copy in the destination you select. That copy is outside the vault's protection. Printing, sending, or sharing an exported file through another application puts it under that application's or recipient's control.

If you select a cloud-synced folder, file provider, or sharing app, it may automatically upload or synchronize the exported file, including an encrypted backup, under your settings. Meritwright Vault Mobile does not choose that destination, provide the cloud service, or upload the file to Meritwright. We cannot control the selected provider's processing, retention, or deletion.

5. Encrypted backups and recovery

The Android app can create a passphrase-protected encrypted recovery backup and restore a compatible backup you select. The backup passphrase protects the portable package; the device-bound credential is not a portable recovery credential.

An exported backup remains encrypted, but it is a separate file outside private app storage. A selected cloud or sharing service may process its filename, size, account information, and encrypted contents under its own policies. Keep the backup passphrase separate from the backup file and protect both.

The Android app is configured to exclude its private app data from Android system cloud backup and device transfer. Reinstalling the app through a store restores the application, not a vault kept only on the previous installation. Portable recovery requires a compatible encrypted backup you retained and its backup passphrase.

Meritwright does not keep your vault, passphrases, or a recovery copy. We cannot decrypt or restore your local data for you. Device loss, clearing app data, or changes to device security may make local data inaccessible without a usable recovery backup.

6. Retention and local-data deletion

Local information remains until you remove it or the device removes the app's storage. In the Android app, use Delete to remove a selected record and its encrypted attachment, if present. To remove the app's local files and preferences, use Android's app-storage controls or uninstall the app, subject to the operating system's behavior. Retain any recovery backup you need before doing so.

Deleting local app data does not delete original source files, previously exported files, encrypted backups, cloud copies, shared copies, store purchase records, or support correspondence. Remove those separately through the relevant location, recipient, or service. Deletion is not a guarantee of forensic erasure.

Device security credentials and any system-retained information follow the operating system's rules. Do not assume uninstalling guarantees that every credential or previously created copy is erased. Apple deletion and retention behavior will be reviewed before that edition is released. Meritwright cannot remotely delete local vault data it does not possess.

7. Apple, Google, and storefront processing

Vault Mobile is planned as a one-time paid download per platform without a subscription. Google Play and the Apple App Store independently process purchases, payment information, storefront region, downloads, redownloads, refunds, updates, and related account or device information under their own policies. The current app has no in-app purchase system and does not read or store payment information, purchase tokens, storefront receipts, or an in-app commerce entitlement.

Initial purchase availability is planned for U.S. storefronts for the 50 states and District of Columbia, excluding U.S. territories and other countries at launch. Storefront settings govern availability; the app does not determine your physical location using GPS, IP, SIM, or billing-address checks.

Store and operating-system services may need network access and independently process diagnostics or account information. That is not a Meritwright upload of vault contents. See Google's Privacy Policy and Apple App Store privacy information.

8. Meritwright.com is separate from the app

Visiting this notice, a product page, or another Meritwright.com page involves the website processing described in the corporate Privacy Policy. Cloudflare delivers and protects the site and may process request and security information. The website also uses Cloudflare Web Analytics for aggregate traffic and performance measurement.

Website measurement is not built-in Vault Mobile analytics and does not give Meritwright access to your local vault. Following an external website or store link brings that destination's separate privacy practices into effect.

9. Support and privacy requests

For product help, email support@meritwright.com with your platform, operating-system version, and a description of the problem. Do not send vault contents, backups, passphrases, device credentials, government identifiers, medical records, store passwords, or payment-card details. Remove sensitive information from screenshots before sending them.

When you contact us, Meritwright receives your email address and whatever you include in your message. Company email is provided through Microsoft 365. We use and retain correspondence to respond, provide support, address security concerns, and meet applicable obligations as described in the corporate Privacy Policy. Support correspondence is separate from local vault data.

Send privacy requests to privacy@meritwright.com. Applicable rights depend on your circumstances and the law. Meritwright can address information it holds, but cannot retrieve, correct, decrypt, or remotely erase local app information it never receives. Meritwright does not sell vault information or share it for targeted advertising.

10. Security, notice changes, and contact

Local processing and encryption do not eliminate every risk of device compromise, loss, malware, unauthorized access, or disclosure. Protect your device, use strong passphrases, and maintain tested encrypted backups. Keep decrypted exports protected separately.

We will update this notice when relevant practices change and identify revisions through the date above. Store disclosures and in-app policies will be reviewed for consistency before commercial release, including review of the planned Apple edition.

Return to Meritwright Vault Mobile