Privacy notice — draft

What DevLockAPI stores for your account: your email address and whether you have verified it, a password verifier (never the password itself), your authenticator setup protected by a server key, sign-in sessions and second-factor checks, and optional reset contacts that you confirm with a code. Optional passkeys store only public credential material and identifiers; the passkey's private key stays with you. Your vault is encrypted on your device before anything is saved. Organization data (credential labels, providers, accounts, purposes, statuses, expiry dates, risk tags, app/service/environment/variable mappings and your private lists) is encrypted with a key wrapped by your recovery passphrase, using Argon2id or PBKDF2. The server stores only ciphertext, encrypted key wrappers, identifiers, revision numbers, sizes and timestamps. Your passphrase never leaves your device. API key values you choose to store are encrypted on your phone with a separate key that exists only in your phone's Android Keystore and in your 24 recovery words. The encrypted copy is saved with your vault, but neither the server nor the website can decrypt it, and the website never shows, copies or receives key values. Your recovery words are not sent to the server. Older fingerprint-only entries remain readable as metadata; a fingerprint is not anonymous and does not prove a key is valid or revoked. Anyone with your unlocked phone, or malicious code running on it, could see what you reveal there. Codes for verification and password resets are sent by an email provider (and a text-message provider, if you add a phone number). To limit abuse, the service keeps short-lived counters keyed by a secret hash of your network address and account; raw addresses are not kept in those counters. Hosting and security providers may process network and device metadata (such as IP address and browser type) to deliver and protect the service. The public directory needs no account. Links to providers open their own sites; DevLockAPI tells your browser not to send which DevLockAPI page you came from, and does not record which provider links you open. Prices, free tiers and status links are collected from providers' public web pages by an automated checker and contain no personal data. Price-change alerts in your lists are worked out on your device from your encrypted lists. The support assistant answers from built-in help articles on your device; what you type into it is not sent to DevLockAPI or to an AI service. Google Play handles payments. For subscriptions, DevLockAPI stores purchase tokens, a pseudonymous account binding, entitlement state and charge and cancellation evidence; it never receives card details. Terms acceptance stores your account ID, the Terms version and hash, the time and your locale. Deletion requests store the email you submit and the request time until your identity is verified. DevLockAPI has no advertising or analytics SDKs and does not sell or share personal data for advertising. Account and billing metadata are not end-to-end encrypted; only vault contents are. Verified deletion removes active account, vault and private-list data without waiting for billing to settle. A protected deletion tombstone suppresses restored accounts. Separately retained minimal Play records have their account reference removed but retain the purchase token, pseudonymous binding and charge and cancellation evidence needed to finish reconciliation. Pseudonymous does not mean anonymous; these records require restricted access and a justified retention policy. The legal basis, operator access and maximum retention period require owner/legal review before consumer launch. Deletion queues cancellation of linked Play renewals, not confirmation; check directly through Google Play during an outage. It does not revoke provider credentials. No fixed production retention promise has been approved. The earlier working proposal for security metadata and encrypted backups was 30 days; hosted jobs, backup expiry and restore/deletion drills require operational verification before this can become a consumer promise. No guaranteed production backup-expiry or recovery time has been established. Submitting a public deletion request only records it for identity verification; it does not bypass MFA, delete content immediately or cancel billing. The service runs on Cloudflare Workers with a Cloudflare D1 database; a separate staging copy at staging.devlockapi.com holds test accounts only. A complete contractual processor inventory, storage regions and international-transfer safeguards have not yet been confirmed. Apple distribution is planned; no Apple purchase integration or Apple billing-data collection is claimed for this build. Verification and password-reset emails will come from aiprobldr@devlockapi.com, sent through Resend; sending is not switched on yet. The app offers only delivery channels configured on the backend; provider configuration and actual delivery must be validated before use. When enabled, the email provider receives the destination email, one-time verification code, verification purpose and delivery metadata. Delivered email is processed and stored by the recipient's and sender's mail providers under their terms. Vault contents, encryption keys, authenticator seeds and recovery passphrases are never included in those messages. Provider template history must be disabled and actual access/retention settings confirmed before activation. Operator identity, privacy contact, countries, legal bases/rights, processors, transfer safeguards, confirmed retention periods, applicable access/correction/deletion/export/complaint rights and their request route, age/child-directed-service rules, and final effective date are pending owner/legal review. Browser storage supports authentication and trusted-device functionality; no optional marketing-cookie consent is bundled into Terms. No sale, advertising-targeting or production cross-border compliance conclusion is established by this draft. This private draft is not a completed consumer privacy policy.