Projects / Cachette

Privacy policy

This Privacy Policy applies to Cachette, an Android encrypted vault published on Google Play as app.cachette.

Cachette is published by the individual developer identified on Cachette’s Google Play listing. For privacy questions, write to the developer contact email shown in the Developer contact section of Cachette’s Google Play listing.

The related Terms of Service cover the licence, the paid download, and the limits of what the vault can and cannot do. A plain-language description of the app is on its overview page.

Summary

  • Cachette does not require an account. There is nothing to sign up for and nothing to sign in to.
  • Cachette does not operate a backend server. There is no developer-run service to which your data could be sent.
  • Cachette does not declare INTERNET. The Android kernel refuses every socket. The app cannot phone home, even if it wanted to.
  • Cachette contains no ads, no advertising SDK, no analytics SDK, no crash-reporting SDK, no remote configuration, and no Google Play Billing library.
  • Cachette does not sell or share personal data.
  • Your photos, videos and documents are encrypted on the device. The pattern you draw is the encryption key; it is stored nowhere.
  • Android cloud backup and device-to-device transfer are switched off for the app. Vault contents do not follow a Google account to another phone.
  • Nothing leaves the device unless you pick a destination yourself — an encrypted backup, an export, or a delete request Android shows you.

Permissions the app requests, and why

Cachette declares no permissions at install. The photo picker, the share sheet, and the Storage Access Framework need none. The permissions below are requested in context, if you use the feature that needs them. There is no location permission, no microphone permission, no contacts or calendar permission, no storage permission for the default path, and no INTERNET permission anywhere in the merged manifest.

Camera

Cachette declares CAMERA. It is requested the first time you tap the in-vault shutter, never at install. Capture writes an encrypted JPEG into the open vault; the photo does not land in the camera roll. Denying the permission leaves every other feature working. Cachette does not declare RECORD_AUDIO.

Photos and videos (shred originals)

Cachette declares READ_MEDIA_IMAGES and READ_MEDIA_VIDEO so the optional “Shred originals” toggle can ask Android to delete the gallery copies of items you just imported, through MediaStore.createDeleteRequest(). That call is permanent — there is no 30-day trash — and Android shows its own confirmation sheet before anything is deleted.

These permissions are requested only when you turn shred on. Import through the photo picker, the share sheet, or a document you pick does not need them, and does not get them. Cachette never uses them to scan your gallery, build a library of what you own, or read media you did not choose to import.

Notifications

Cachette declares POST_NOTIFICATIONS (required on Android 13 and later) so a long import can show a progress notification after you leave the app. The notification is marked secret: it shows a count such as “Cachette — 34 of 210” and nothing else. No filename, no thumbnail, no preview. Granting the permission does not, by itself, post anything; with no import running, nothing is posted.

Foreground service

Cachette declares FOREGROUND_SERVICE and FOREGROUND_SERVICE_DATA_SYNC so an import that you started can finish encrypting files after you switch away. “Data sync” here is Android’s name for that class of local work; the service does not talk to a network. It is not exported, and it does nothing until you import something.

Internet

Cachette does not declare INTERNET. Transitive libraries that would add ACCESS_NETWORK_STATE or WAKE_LOCK have those permissions stripped. A release build that contains INTERNET fails its own gate. You can confirm what Android has granted in Settings → App info, and the in-app Verify screen prints the same list.

Information processed on your device

Vault contents

Photos, videos, PDFs and other files you import or capture are encrypted with AES-256-GCM under a key derived from the pattern you draw, mixed with a hardware-held pepper that never leaves StrongBox. Each file is stored under a random 128-bit name in the app’s private storage. There is no vault list and no stored “correct pattern”: unlocking tries every header, and a pattern that decrypts nothing opens an empty vault.

This information is never uploaded. There is no socket through which it could leave. The developer cannot read it, recover it, or reset it.

The pattern

The pattern is fed to Argon2id and then HMAC-SHA256 with the StrongBox pepper. The result is the vault key. The pattern is not stored, not hashed for comparison, and not backed up. Forget it, and the on-device vault is unreadable. A 24-word phrase protects only an exported backup you chose to make, not the pattern itself.

In-memory preview

While a vault is unlocked, decrypted bytes are streamed into the image and video decoders. They are not written to a plaintext temp file, a thumbnail cache, or shared storage. Turning the screen off locks the vault and wipes the keys from memory.

Import progress

A running import holds, in memory, how many items have been encrypted so the notification can show a count. That count is not a filename and is not written as a permanent index of vault contents.

App settings

Cachette stores a small local config: Argon2 parameters, a random salt that reveals nothing about you, and display choices such as theme. It does not store the pattern, the 24-word phrase, a vault count, or a file list.

Android backup and device transfer

Cachette sets android:allowBackup="false" and excludes every storage domain from cloud backup and from device-to-device transfer. Vault blobs, settings, and the hardware pepper do not ride a Google account onto another phone. A factory reset, or a lost device, ends the on-device vault. The encrypted backup you export yourself is the only way back.

Information sent off your device

Cachette the app sends nothing. It cannot open a network connection. The cases below leave the app only because you handed them to another app or to Android.

Encrypted backup

When you make a backup, Cachette writes one encrypted file to a location you pick through Android’s document picker — local storage, an SD card, or a cloud provider such as Drive. Cachette does not upload the file; the app you picked might. The file is unreadable without the 24-word phrase, which is shown once and is not stored by Cachette. Once the file sits where you put it, that destination’s own privacy policy governs it.

Export and share

If you export or share an item out of the vault, Cachette decrypts it to a destination you choose. From that moment the copy is an ordinary file under your control, and whatever you send it to handles it under its own policy. Cachette does not keep a plaintext copy.

Shred originals

Deleting a gallery original is an Android system sheet. Cachette asks MediaStore to delete items you imported; Android confirms with you. Nothing about that request leaves the phone.

Google Play

Cachette is a paid app. The purchase happens in Google Play, before or as you install. Cachette contains no billing library and never talks to Google Play from inside the app. Payment details, the Google account, and purchase history are handled entirely by Google under the Google Privacy Policy. The developer never sees your card, bank details, billing address, name, email address, or Google account.

Information Cachette does not collect

Cachette does not operate user accounts and does not collect, store, or transmit any of the following to developer-operated services:

  • name, email address, or phone number
  • contacts, calendar, or messages
  • your pattern, your 24-word phrase, or any biometric
  • your photos, videos, or documents
  • location of any precision
  • payment card or bank details
  • advertising identifiers, device fingerprints, or any identifier used for tracking
  • analytics events, usage statistics, performance traces, or crash reports

Data sharing

Cachette does not sell personal data and does not share personal data for advertising or analytics. There is no pipe through which the developer could share it.

Information is processed by third parties only where a step you take requires it:

  • Google Play, when you buy or install the app
  • the app or cloud provider you pick as the destination for a backup or an export
  • Android’s MediaStore confirmation sheet, when you shred an original

Data retention and deletion

There is no server-side copy of anything, so there is nothing for the developer to retain or delete. Data on your device stays there until you remove it.

You can remove local Cachette data by:

  • deleting items inside an unlocked vault
  • clearing Cachette’s storage in Android system settings
  • uninstalling Cachette, which deletes its private storage entirely

Deleting the app does not delete an encrypted backup or an export you saved elsewhere; those are ordinary files under your control. A pattern you have forgotten cannot be recovered by the developer, by Google, or by uninstalling and reinstalling.

Purchase records are held by Google Play and in your Google account purchase history. Those are controlled by Google.

Cachette does not offer account deletion because it does not create or manage accounts.

Your choices

  • You can use Cachette without an account and without granting any permission.
  • You can decline the camera; import through the picker and the share sheet still works.
  • You can leave shred originals off, in which case the media permissions are never requested.
  • You can decline notifications; imports you start still encrypt, without a progress notice once you leave the app.
  • You can choose never to make a backup or an export, in which case nothing encrypted ever leaves the app’s private storage.
  • You can uninstall Cachette at any time like any other app.

Security

Vault contents live in the app’s private storage, protected by Android’s app sandbox, file-based encryption, AES-256-GCM per file, Argon2id, and a StrongBox-held pepper. Every window sets FLAG_SECURE, so the system blocks screenshots, recordings, casts, and the recents thumbnail. The screen-off lock wipes keys from memory. Android backup is off.

No method of storage is perfectly secure. Cachette reduces that risk structurally rather than by promise: it has no server, no account, no analytics or crash-reporting SDK, and no network permission.

Limits that belong in a privacy policy rather than in marketing copy: a forensic image of the phone can still see how much encrypted data is stored; copies that left the phone before import are beyond the app; a rooted or malware-infected device beats the sandbox; deniability is for the person holding your unlocked phone, not for a laboratory with a disk image.

Children’s privacy

Cachette is a general-audience encrypted vault. It is not designed for or directed to children under 13, is not a Families programme app, and collects no personal data from anyone, including children.

International users

Because no personal data is collected, transmitted to, or processed by the developer, there is no international transfer of your data by Cachette, and no developer-held record about you to access, correct, port, or erase. Rights you hold under the GDPR, the UK GDPR, the CCPA, or comparable laws remain available to you; a request under them will be answered honestly, which in practice means confirming that no such data exists.

Data you send to Google by purchasing through Google Play, or to a cloud app you picked as a backup destination, is handled by them under their own policies, and your rights against them are exercised with them.

Changes to this policy

This Privacy Policy may be updated if Cachette’s features or data practices change. The effective date at the top of this page will be updated when that happens, and material changes will also be noted in the app’s Google Play release notes. This page remains available at its published address, https://glippi.dev/projects/cachette/privacy-policy.

Google Play Data safety summary

For transparency, these are the answers this app supports on the Play Console Data safety form. If the app’s behaviour ever changes, this policy and that form are updated together.

  • Does the app collect or share any of the required user data types? No.
  • Photos and videos, files and docs, audio. Not collected and not shared. They are encrypted on the device and are never transmitted by the app.
  • Personal info, financial info, location, health, messages, contacts, calendar. Not collected and not shared.
  • App activity, app info and performance, device or other identifiers. Not collected and not shared. There is no analytics or crash-reporting SDK in the app.
  • Purchase history. Handled by Google Play as the store of record; not collected by the app for its own purposes. The app contains no billing library.
  • Is all user data encrypted in transit? Not applicable — the app transmits no user data, and cannot open a socket.
  • Can users request that data be deleted? Not applicable to server data, as none exists. On-device data is deleted in the app, by clearing app storage, or by uninstalling.

Contact

For anything about this policy or your data, write to the developer contact email shown in the Developer contact section of Cachette’s Google Play listing.