Privacy Policy for Chabi Ghar

Last Updated: July 28, 2026

1. Introduction

Chabi Ghar ("the app") is developed by Arohantra. This Privacy Policy explains what data the app accesses, how it is stored, and how it is used.

2. What the App Stores, and Where

• All entries (titles, usernames, passwords, URLs, notes, TOTP secrets) are stored in a single encrypted database file (SQLCipher, AES-256) on your device only.
• Your master password is never stored. A key derived from it (Argon2id) unlocks the vault; the derived key exists only in memory while the app is unlocked and is erased when the app locks.
• If you enable biometric unlock (Face ID / Touch ID / Android biometrics), a wrapped copy of your vault key is stored in the platform's secure hardware-backed keystore (iOS Keychain + Secure Enclave, or the Android Keystore), gated by your enrolled biometrics. This key never leaves your device.
• Clipboard copies of passwords/usernames expire automatically after a short time and are marked so they don't sync to other devices via the OS's own "Universal Clipboard"-style features.
• Autofill (iOS Credential Provider / Android Autofill) reads only from your local encrypted vault to fill in credentials you already saved; it does not send anything off-device.

3. What We Don't Do

• No account creation, sign-in, or cloud sync of any kind.
• No analytics, telemetry, advertising IDs, or crash reporters.
• No third-party SDKs that collect or transmit data.
• No access to your contacts, location, camera, microphone, or any data beyond what's needed to store and autofill the entries you create.

4. Backups and Export

If your OS backs up app data (e.g. iCloud/Google device backup), the encrypted vault file may be included in that backup like any other app file — it remains encrypted with your master password/derived key, which we never have access to.

Export is user-initiated only: you can export your vault to an encrypted file (.cgvault) for your own backup or transfer purposes. That export file is created and stored by you; we never see it.

5. No Recovery

Because your master password is never stored anywhere — by us or by the app — losing it means the vault cannot be recovered by anyone, including the developer. There is no "forgot password" flow.

6. Children's Privacy

The app is not directed at children under 13. We do not knowingly collect information from children.

7. Changes to This Policy

If this policy ever changes (for example, if a future version adds an optional feature that involves data leaving the device), the change will be described here with a new "Last Updated" date before that version ships, and the in-app description will be updated to match.

© 2026 Snehangshu Baul (Arohantra). All rights reserved.
This is an offline-first, privacy-focused password manager.