MyPassBox ("the app") is a password manager. This policy explains what the app does and does not handle, and how we protect your data. Please read it before you start using the app.
1. Storage and encryption
Your vault data — passwords, usernames, notes — is encrypted on your device with AES-256-GCM. Encryption and decryption happen only on your device.
Your data is encrypted with a randomly generated data key. That key never leaves your device in plain form. There are two ways to use the app:
• Default (device key mode): the data key is wrapped by key material stored on this device, so the app opens straight away and you do not have to remember a password. Be aware that anyone who can unlock this device can read your data.
• Optional (master password mode): the data key is instead wrapped by a key derived from your master password using PBKDF2-SHA256 with 100,000 iterations. Without the master password the data key cannot be unwrapped, even if the database file is copied off the device.
In master password mode you can generate a recovery code (a 32-byte random credential) to get back in on this device if you forget the password. It is shown only once — write it down and keep it offline. We provide no server-side way to recover or reset a master password.
2. What we do and do not collect
To be explicit: when you sign in with an account, we collect your phone number and store it on our servers, to register you, sign you in, help you recover the account, and send SMS codes. That is the only personally identifying information the app collects.
Beyond that, we do not collect:
• Names, ID numbers, or other identity information
• Location data (GPS or otherwise)
• Device identifiers (IMEI, model, and the like)
• Usage analytics (taps, time in app)
• Contacts, SMS content, or call history
Your vault contents — passwords, usernames, notes — are never uploaded to our servers, and we cannot read them.
3. Network access and uploads
The app uses the network in these cases:
• Account sign-in, registration, and SMS codes
• Fetching icons for well-known websites and apps (only the site domain is sent to match an icon; none of your accounts or passwords are sent)
• If you turn on "sync to Huawei Cloud" in Settings, encrypted data is synced between HarmonyOS devices signed in to the same Huawei ID
Note that sign-in and icon fetching use the network even when sync is off. Unless you turn sync on, your vault data does not leave this device.
About device-to-device sync: the app uses HarmonyOS distributed data sync, which only works between HarmonyOS devices signed in to the same Huawei ID. It does not apply to iOS, Android, or Windows. The switch is not yet wired up — turning it on performs no sync today, and we will tell you in-app when the feature becomes available.
4. Permissions
The app requests only these permissions:
• Network: for account sign-in and SMS codes, and — if you enable them — icon fetching and device-to-device sync.
• Biometrics: for fingerprint or face unlock. Biometric data is managed by the system; the app cannot access the raw data.
5. Data security
• Cipher: AES-256-GCM, a widely recognised strong symmetric standard.
• Key derivation: master password mode uses PBKDF2-SHA256 with 100,000 iterations to raise the cost of brute force.
• Key protection: in default (device key) mode, the material needed to unwrap the data key is kept on this device — preferably in the system hardware keystore (HUKS), with a fallback copy in the app's private directory. The fallback is deliberate: in this mode you have no master password and no recovery code, so if the hardware key becomes unusable (a new device, a system-invalidated key) there is no second way back and the data would be lost for good. The cost, stated plainly: **anyone who can read the app's private directory on this device can unlock your vault.** If that matters to you, turn on master password mode under "Vault encryption" — doing so erases that fallback copy immediately.
• If you enable device-to-device sync, the sync package includes the wrapped data key — otherwise a new device could not decrypt the data. The key that unwraps it exists only on your device and in your master password or recovery code; the server cannot unwrap it. We do not and cannot keep a key on our servers that can decrypt your data.
• Auto-lock: the app can lock itself after a period of inactivity.
6. Third-party services
The app uses the following third-party capabilities and integrates no others:
• Huawei ID (AccountKit): for "sign in with Huawei ID".
• Huawei SMS: for sending sign-in and registration codes (called by our servers).
• Icon assets: icons for well-known sites and apps come from public icon sources and are matched by domain only; no personal data is involved.
7. Your rights
• Export: all your data to an encrypted file at any time, for backup or migration.
• Delete: delete individual records or clear all data at any time.
• Uninstall: uninstalling the app makes the system remove all data on this device (vault, database, exported files and keys), leaving nothing behind.
• Backup files: any backup file you have copied or saved to a public folder such as "Files" is not removed by uninstalling the app, and remains yours to manage.
• Close your account: close it yourself at any time under Settings → Delete account; no need to contact us. We then delete the phone number, the account record and the synced cloud data from our servers. This cannot be undone. The vault on this device is kept, and you can clear it yourself.
• Turn off sync: turn device-to-device sync off at any time; data already synced can be deleted from the Huawei Cloud management page.
8. Updates and contact
This policy may be updated from time to time; we will tell you in-app when it changes. If you have any questions, please contact the developer.