Seakret privacy policy

Effective date: 4 November 2026 App: Seakret (Android package app.seakret), published on Google Play as "Seakret" Developer: Out By One, South Africa (the developer name shown on Google Play) Privacy contact: support@seakret.com This policy is published at: https://seakret.com/privacy

In short

• Seakret is a private vault for your photos, videos and files. Everything you put in it is encrypted on your phone.
• Seakret has no accounts, no servers of its own, no analytics, no advertising and no crash reporting. We (the developer) do not receive your files, your recovery phrase, your pattern or passphrase, your name or email address, or any information about how you use the app.
• The app uses the internet for two things only, and only when you use them: backing up to, restoring from, and disconnecting from your own Google Drive, and Google Play (to buy Seakret Pro and to check what you own). Those flows go to Google, not to us.
• Google, not us, receives certain information when you use those two features. This policy lists what.
• If you lose both your phone and your recovery phrase, nobody, including us, can recover your vault.

What Seakret keeps on your phone

• Your vault. Photos, videos and files you add, together with their names, albums, notes and thumbnails, are encrypted with AES-256-GCM before they are written to the app's private storage. The encryption keys are protected by a key derived from your pattern or passphrase (Argon2id), by a key held in your phone's Android Keystore (in dedicated secure hardware where your phone has it), and, if you turn it on, by your fingerprint or face. Your recovery phrase (24 words) can re-create access on a new phone together with a backup.
• Settings. Appearance, lock timeout, grid size, sort order, whether screenshots are blocked, the type of lock you chose, a count of recent wrong attempts and when the next attempt is allowed, and which launcher icon you picked. These stay on the phone and are never sent anywhere.
• A note about Pro. If you buy Pro, Seakret keeps an encrypted note on the phone of the last answer Google Play gave (which plan, and when), so Pro keeps working for up to 14 days without a connection.
• Biometrics. If you use fingerprint or face unlock, Android does the matching. Seakret never sees or stores your fingerprint or face data; it only receives "yes" or "no" from Android.
• Files you add. You choose them through Android's photo picker or file picker. Seakret does not request permission to read your photos, videos or storage in general, and it can only read what you select.

What leaves your phone, and why

1. Backups to Google Drive (optional)

If you connect your Google account in Seakret and choose "Back up now", Seakret uploads one archive of your vault to Google Drive. If you restore from Google Drive, Seakret downloads it. This is the only way any part of your vault leaves your phone, apart from files you export yourself.

The permission. Seakret asks Google for one permission, https://www.googleapis.com/auth/drive.appdata. It lets Seakret read and write its own hidden application-data folder in your Drive. Seakret cannot see your other Drive files. The folder does not show in the Drive app, but it uses your Drive storage. Google describes it as a folder that is "only accessible by your app and its contents are hidden from the user and from other Google Drive apps".

What is inside the archive, and who can read it. The photos, videos, files, thumbnails, file names, albums and notes in the archive are encrypted on your phone, with keys that only you hold (your unlocked vault and your recovery phrase), before anything is uploaded. Google and we cannot read them. The upload is sent over an encrypted (HTTPS) connection.

What Google can see anyway. Encryption does not hide that a backup exists. Google Drive holds, and can see:

• the file's name: it starts with sk- followed by random characters, and is different for every backup;
• its size, the time it was created and a checksum of the file;
• a label stored with the file: a fixed 32-character code made from the vault's keys. It is the same on every backup of that vault, so Google can tell which backups belong together; it says nothing else about the vault;
• the layout of the encrypted file: the file begins with the text "SKBACKUP" and a format number; it lists, for each encrypted piece, a random identifier, a type (record, item or thumbnail) and its exact length. From this, someone who can read the file can estimate roughly how many items a vault holds and how large they are, and which were added or removed between two backups. File names, albums, notes, dates and contents are not visible;
• which Google account made the request and the usual technical details of an internet request, such as your IP address and your phone's model and Android version, as with any app that uses Google Drive.

What we receive. Nothing. Backups go from your phone straight to your Google account. We have no copy of your backup and no access to your Drive.

Your Google account details. Google's own account chooser and permission screens are used. Seakret asks Google only for the Drive permission above, not for your name, email address or profile picture, and the answer Google gives Seakret is an access token for that permission, not a description of you. Seakret does not store your Google account name, email address or any other account identifier, and does not send any such detail to us or to anyone other than Google. The only exception is technical and temporary: while the app is running, Google's software may hand Seakret a reference to the account you chose; Seakret keeps it in memory only, never writes it to your phone's storage or to any log, and uses it for one thing, passing it back to Google's software when you choose "Disconnect Google", after which it is discarded. The access token is also kept only in memory, is sent only to Google over HTTPS, and is never saved by Seakret; Google Play services on your phone, not Seakret, holds the grant and caches tokens. Google's privacy policy applies to how Google handles your account and Drive data: https://policies.google.com/privacy.

Restoring. To find your backups on a new phone, Seakret reads the first part of the backup files in that hidden folder and tries your recovery phrase on them. Files your phrase does not open (for example another vault's backup) are skipped and not kept.

Stopping. "Disconnect Google" in Seakret asks Google to withdraw the permission (this contacts Google). You can also remove it at https://myaccount.google.com/permissions. Backups already in Drive stay there until you delete them in Seakret (Settings, Google Drive backup), or delete Seakret's hidden app data in your Google Drive settings.

2. Google Play (optional, for Pro)

Seakret uses the Google Play Billing Library. Google Play processes payment and manages subscriptions; Seakret never sees your card number, bank account or other payment details, and the payment screen is Google's. To know whether you own Pro, Seakret asks Google Play which Seakret products you have bought. Google Play answers with the product, its state (for example purchased, pending, whether a subscription is set to renew) and a purchase token. This is purchase history for Seakret's own products. Seakret uses it only to switch Pro on or off, sends the purchase token back to Google Play only to confirm ("acknowledge") a purchase, keeps only the encrypted note described above, and sends nothing about it anywhere else (it has no server). Google's own services on your phone (Google Play Store and Google Play services) communicate with Google as part of this, and Seakret does not control or see everything they collect; see Google's privacy policy https://policies.google.com/privacy and Google Play's terms.

3. Things you do yourself

If you export a file, or save a backup file, to a location you choose, that file goes where you put it. Seakret cannot protect copies after they leave the vault.

If you use "Take a photo" or "Record a video" in "Add to your vault", the camera app on your phone does the capturing: Seakret asks for no camera permission. Seakret gives the camera one temporary file in its own private storage, encrypts what the camera wrote into your vault, and deletes the temporary file straight afterwards (also when the vault locks and each time the app starts). Seakret does not save the picture to your gallery. What the camera app itself does with a picture is covered by that app's own policy.

Third parties

Third party	What for	What it receives	When
Google (Drive)	Storing your encrypted backups in the app's hidden folder	The encrypted archive and the information listed above	Only after you connect Google and choose to back up, restore or disconnect
Google (Google Play, Play Billing, Google Play services, the Google account chooser and permission screen)	Purchases, ownership check, the permission screen for Drive	What Google Play and Google Play services collect under Google's own policy; the purchase information above	Only when you use Pro or Drive backup

We do not sell data, we do not share data with advertisers or data brokers, and we do not use any analytics, advertising or crash-reporting service. A transfer to Google that you start (a backup, a purchase) is a transfer to the provider you chose; it is not a sale.

Permissions the app asks for

• Internet (INTERNET): Drive backup and Google Play, as above.
• Biometric unlock (USE_BIOMETRIC, and USE_FINGERPRINT on older Android versions): optional fingerprint or face unlock.
• Google Play Billing (com.android.vending.BILLING): buying and checking Pro.
• Network state and wake lock (ACCESS_NETWORK_STATE, WAKE_LOCK): added by Google's Play Billing library (its data-transport component). Seakret does not use them for anything of its own.

Seakret does not ask for access to your contacts, location, camera, microphone, phone, accounts or general storage.

How long data is kept, and your choices

• Everything on your phone stays until you delete it or uninstall Seakret, which removes the vault from the phone. Without a backup and your recovery phrase it cannot be brought back.
• Backups in your Drive stay until you delete them (in Seakret) or remove the app's hidden data from your Google account. We cannot delete them for you, because we cannot see them.
• Because we hold no copy of your data and no account for you, there is nothing for us to access, correct, export or delete on our side. If you contact us about privacy we will answer, but we cannot look anything up. Your rights over what Google holds are exercised with Google.
• You can turn off Pro by cancelling the subscription in Google Play (the Pro screen in the app has a "Manage subscriptions in Google Play" button); Seakret never deletes or hides your vault because of a lapsed subscription.

Security, and what it cannot do

Seakret uses well-known building blocks (AES-256-GCM through Google Tink, Argon2id, the Android Keystore). The design is documented, but it has not been audited by an independent security firm. It cannot protect against a phone that is already infected with malware, someone watching you type, screenshots or copies you make yourself, or someone who knows your pattern or passphrase and has your phone. A 6-dot pattern is convenient, not unbreakable; a long passphrase is much stronger. Deleting a file does not guarantee that the flash storage forgets it; encryption is what protects it. Backups are in a preview state: restore one yourself before you rely on it.

Children

International

Google handles Drive and Google Play data under its own terms and may process it in other countries. We do not transfer your data anywhere ourselves.

Changes

If Seakret's data handling changes (for example a new service), we will update this policy and the "Privacy", "What Google Drive can see" and "Google Play" sections in the app before the change ships. The effective date above changes when the policy does.

Contact

support@seakret.com · Out By One, South Africa