PADLOCKPrivacy Policy
Summary: your conversations, calls, files and wallet are yours alone. They are encrypted on your phone and we do not have the keys to open them. We do not ask for a phone number, email or name, we have no ads and we do not sell data.
1. Controller
Padlock is developed and maintained by an independent developer based in Portugal (European Union), who is the controller of the limited data described here. Contact: padlockapp@proton.me.
2. How you are identified
- Padlock does not ask for a phone number, email or real name.
- Your Privacy ID is derived mathematically on your phone from a cryptographic key pair generated when you create your account.
- There is no central directory of users. The app does not access your phone's contacts.
3. Messages and calls
Messages, voice notes, photos, documents and voice/video calls are end-to-end encrypted before they leave your phone. We never hold the keys. Messages use sealed sender: the server knows where to deliver a packet but not who sent it. Packet sizes are padded.
4. What the server sees
| Data | Stored? | Purpose |
|---|---|---|
| Message or call content | Never (only exists encrypted) | — |
| Encrypted packet awaiting delivery | Until delivered, max. 72 hours (calls: 90 seconds) | Deliver when the recipient comes online |
| Destination ID | In memory only, while the packet waits | Routing |
| IP address | In memory only, during the connection | Keep the connection; never written to files |
| Push notification token | In memory only; lost when the server restarts | Wake the phone for new messages or calls |
| Aggregate counters (daily active users, logins, messages, calls, traffic) | Numbers only, no IDs or IPs; active users are counted with a code that changes every day and is deleted at the end of the day | Know how many people use the app and detect server problems |
| Logs with IDs or content | Never written | — |
5. Data stored on your phone
- Chats, contacts and settings exist only on your phone, in an encrypted vault (AES-256-GCM). There is no cloud copy.
- The vault key is derived from your passphrase (Argon2id) combined with a device secret in the Android Keystore. There is no recovery: if you lose the passphrase, the data is lost, even to us.
- Messages self-destruct within 24 hours at most and are overwritten on disk.
- Login is always required (no fingerprint, no "remember me"); sessions lock after 15 minutes except during a call.
- Photos and documents are stored in Secure Vault Files, protected by a second password.
- The Destroy Vault button (Panic Room) instantly erases your ID, chats, files and wallet from this phone.
6. Android permissions
| Permission | Purpose |
|---|---|
| Microphone | Calls and voice notes, only while recording or in a call |
| Camera | Video calls, taking photos into the vault, scanning QR codes |
| Notifications | Alerts for new messages and calls (without content) |
| Full-screen intent, overlay | Showing an incoming call while the phone is locked |
| Foreground service, wake lock | Keeping a call active with the screen off |
| Bluetooth, audio settings | Bluetooth headsets and switching speaker/earpiece |
| Internet, network state | Sending/receiving and reconnecting when the network changes |
Padlock does not request location, contacts, SMS or call log access.
7. Push notifications
We use Firebase Cloud Messaging (Google) only to wake your phone when a message or call arrives while the app is closed. Google sees that a notice is addressed to a technical device token, never the content or the sender.
8. Crash reports
We use Firebase Crashlytics (Google) to learn about technical errors. It collects only technical data (where the error occurred, device model, Android and app version, a random installation identifier). It never collects message content, contacts, keys, wallet addresses or personal data. It is only active in published builds.
9. CryptoVault
- The wallet is non-custodial: the 24-word recovery phrase is created and stored only on your phone. We never receive it and cannot recover funds.
- To show balances and send transactions, the app talks directly to public blockchain nodes (section 11), which see your public wallet address and IP, as with any wallet.
- Prices come from CoinGecko; the request contains only the coin name.
- Transactions are recorded on the public blockchain, which is visible to anyone and not controlled by us.
10. Purchases and subscriptions
Subscriptions are processed by Google Play. Payment and billing data stay with Google under its privacy policy. We do not receive your name, email or payment details. The app only verifies, on the device, Google's digital signature on the purchase receipt.
11. Third-party services
| Service | Function | Data processed |
|---|---|---|
| Google Firebase | Push notifications, crash reports | Device token; technical error data |
| Google Play | App distribution, payments | Google account and payment data |
| Cloudflare | Call relay (TURN) | Already-encrypted call traffic; IP address |
| Render | Signalling server hosting | Encrypted packets, temporarily; IP address |
| 1RPC, PublicNode, dRPC, Arbitrum (blockchain nodes) | CryptoVault balances and transactions | Public wallet address, signed transactions, IP |
| CoinGecko | Coin prices | Requested coin name, IP |
Some of these providers may process data outside the EU under GDPR safeguards such as standard contractual clauses. None of them receives the content of your conversations.
12. Legal basis (GDPR)
Performance of contract (delivering messages, notifications, calls, subscription) and legitimate interest (keeping the app stable and secure through crash reports). No marketing, profiling or automated decision-making.
13. Retention
- Encrypted packets on the server: until delivered, max. 72 hours.
- Push token: memory only, never written to disk.
- Crash reports: per Firebase Crashlytics retention (90 days).
- Everything else lives only on your phone and disappears when you delete it or uninstall the app.
14. Children
Padlock is not directed at children under 16. As we collect no identifying data, we cannot verify age; if we learn that a minor is using the app without appropriate supervision, we will take the measures available to close the corresponding account.
15. Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, portability and objection. In Padlock your data lives on your phone, where you can view, edit and erase it (Destroy Vault or uninstall). For any request, email padlockapp@proton.me. You may also lodge a complaint with a supervisory authority; in Portugal, the CNPD.
16. Changes
We may update this policy when the app changes. The date at the top always shows the latest version; important changes will be announced in the app.