Privacy Policy - Onvellum

Effective Date: August 12, 2026
Last Updated: August 12, 2026

App Name: Onvellum - Cards & Docs Wallet

1. OVERVIEW & COMMITMENT

Onvellum ("we," "our," or "us") is dedicated to protecting your digital privacy and personal security. This application is designed as an offline-first, zero-knowledge digital vault for encrypted payment card organization, identity document storage, and scanned document management.

We respect your digital privacy completely: Onvellum does NOT collect, store, transmit, or share any personal information, financial data, location data, or device identifiers to remote servers.

2. ZERO PERSONAL DATA COLLECTION & FINANCIAL DATA DISCLOSURE

We do not collect any Personally Identifiable Information (PII) or financial data from our users.

• You are not required to create an account, log in, or provide any personal details (such as name, email address, or phone number) to use Onvellum.

• Financial Information (Payment Cards): Credit card numbers, debit card numbers, cardholder names, expiration dates, CVVs, and issuing bank names entered by you are stored exclusively in locally encrypted database files on your device. This data is never processed for monetary transactions, never transmitted to payment gateways, and never shared with financial institutions.

• Personal Identity Documents & Scans: Driver's licenses, passports, national ID cards, medical IDs, PDF files, and scanned documents imported by you remain on your device in an encrypted vault format.

• Master Passcode: Your 4-digit Master Passcode is used locally with PBKDF2 key derivation (SHA-256) to unlock the app and decrypt items in volatile memory. Your passcode is never transmitted, stored in plaintext, or accessible to us.

3. ZERO THIRD-PARTY ANALYTICS & ADVERTISING

Onvellum is built without any third-party tracking or commercial advertising frameworks.

• We do not integrate any third-party advertising SDKs, analytics services, tracking pixels, or crash-reporting tools (such as Google Analytics, Firebase, Facebook SDK, or Mixpanel).

• We do not sell, rent, trade, or share your data with any third parties under any circumstances.

• We do not run any background telemetry, location tracking, or behavioral analytics.

4. DEVICE PERMISSIONS & PROMINENT DISCLOSURES

To perform user-requested actions locally, Onvellum requests access to specific device capabilities:

• Camera Permission: Used strictly on-device when you choose to take a photo of an identity card or document to add it to your vault. Captured photos are immediately encrypted and saved locally.

• Photos / Media / Gallery Permission: Used strictly on-device when you choose to select an existing photo or PDF document from your gallery to import into your vault.

• Storage / Downloads Permission: Used strictly when you explicitly request to export or download a decrypted document or ID card photo to your device's public Downloads folder.

• Biometrics / Fingerprint (Optional): Used locally via system APIs to authenticate app unlock if enabled in your device settings.

5. DATA SECURITY & AES-256 ENCRYPTION

All data written to your device storage is encrypted using hardware-backed AES-256-CBC encryption.

• Key derivation is enforced locally using PBKDF2 with SHA-256 and random salts.

• Decryption occurs purely in volatile RAM during active viewing. Plaintext files are never written to permanent unencrypted disk storage.

6. DATA DELETION & ACCOUNT ERASURE POLICY

In accordance with Google Play's User Data policy regarding Data Erasure:

• Zero-Account Model: Onvellum does not require an online user account. Therefore, no online account deletion request is necessary.

• In-App Item Deletion: You can delete individual cards, ID cards, or documents at any time within the Application.

• Complete Vault Erasure: You can execute a total data wipe at any time by selecting Settings > Danger Zone > Delete All Data. This action immediately overwrites and permanently deletes all local database files, encryption keys, and cached files from your device.

• App Uninstallation: Uninstalling Onvellum from your device permanently removes all local vault data. Deleted data is completely unrecoverable.

7. IN-APP PURCHASES & PAYMENT PROCESSING

Onvellum offers voluntary in-app donations to support independent application development.

- All financial transactions and payment processing are handled entirely and securely by Google Play Billing (via Google Play Store).

- Onvellum does NOT collect, store, access, or process your bank account details, credit card numbers, or billing addresses. All billing operations are governed by Google's Privacy Policy: https://policies.google.com/privacy.

8. CHILDREN'S PRIVACY COMPLIANCE (COPPA & GDPR-K)

Onvellum does not direct its services to children under the age of 13 (or under 16 in the European Union). Because Onvellum collects no personal data from any user, we do not knowingly collect personal information from children.

9. CHANGES TO THIS PRIVACY POLICY

We may update our Privacy Policy periodically to reflect app enhancements or legal compliance requirement updates. Any changes will be published directly within the Application and on our official privacy policy web page with an updated Effective Date.

10. DEVELOPER CONTACT INFORMATION

If you have any questions, concerns, or requests regarding this Privacy Policy or Onvellum's data practices, please contact the developer at:

Application Name: Onvellum - Cards & Docs Wallet

Developer Email: theheisenberg.dev@gmail.com 

© 2026 Onvellum. All rights reserved. Built for security, privacy, and peace of mind.