Privacy Policy
Gift Card Vault for Android and iPhone
Last updated 3 October 2026
Gift Card Vault collects nothing, sends nothing, and has no way to.
There is no account, no server and no analytics. On Android the app does not even request the internet permission, so the operating system itself prevents it from making a network request — this is not a promise we ask you to take on trust, it is enforced by your phone and visible on the Play Store listing.
What we collect
Nothing. No account, no sign-in, no email address, no device identifiers, no usage analytics, no advertising SDK, no crash reporting.
What leaves your device
Nothing. The app makes no network requests of any kind.
The only way information leaves your phone is if you use the Export feature yourself. That creates an encrypted backup file and hands it to your phone's own share sheet, where you choose the destination. We never see it, and it stays encrypted with your master password wherever you put it.
What is stored, and where
The gift card details you enter — brand, code, PIN, value and expiry — are stored in a single file inside the app's private storage, encrypted with AES. The key is derived from the master password you choose the first time you open the app.
We do not know that password and cannot recover it. If you forget it, the data cannot be decrypted by anyone, including us. That is the design, not a limitation.
The file is excluded from cloud backup — Google Drive backup on Android, iCloud and encrypted Finder/iTunes backups on iPhone — so your codes do not travel to a cloud account without you choosing it.
The paste feature
Pasting a voucher email into the app to pull out the brand, code, PIN, value and expiry happens entirely on your phone. The text is never uploaded, never sent to a service for parsing, and is not retained anywhere after you save or discard the result.
Scanning with the camera
The Scan tab can read a gift card through your phone's camera, so you do not have to type the code. The camera is switched on only while the Scan tab is on screen, and switches off the moment you leave it, close it, lock the vault or leave the app.
Each camera frame is read on your phone to find the store, code, PIN, value and expiry, then discarded. Nothing is photographed, recorded, saved or sent anywhere. You check what was read before anything is saved.
Permissions
The app asks for only two things, each for one purpose:
- Camera — only for scanning, as described above. Android asks you the first time you tap Start scanning; if you say no, everything else works and you can type cards in instead.
- Fingerprint — only to show your phone's own fingerprint prompt if you turn on fingerprint unlock. Your fingerprint never reaches the app; Android only tells it whether the match succeeded.
No internet, no storage, no contacts, no location. The app has no internet permission at all, so nothing the camera sees could leave your phone even if the app tried.
Children
The app is not directed at children and collects no data from anyone, of any age.
Deleting your data
Uninstall the app. There is no other copy — no server-side account to close and nothing for us to delete on your behalf, because we never had it. Any backups you exported yourself remain wherever you put them.
Changes to this policy
If this policy ever changes, the date at the top changes with it. We do not have a mailing list to notify you on, for the same reason as everything else on this page.