Skip to content

Privacy policy

KAPEVault does not collect your data. Your vault is encrypted on your device, and it only travels to storage you choose.

Effective 10 October 2026

What we collect

Nothing, from the apps. KAPEVault has no account, no analytics, no telemetry, no ads and no crash reporting. BrewedOps runs no server the apps talk to, so we never see your vault, your master password or how you use the app.

What the apps keep on your device

  • The vault file, encrypted. On Windows it lives in %APPDATA%\KAPEVault, on Android in the app's private folder.
  • Inside the encrypted vault: your items, a picture for each space if you choose one, the last 20 passwords the generator made (kept 90 days, on that device), and deleted items for 30 days. All of it is in the backups you make.
  • A settings file with nothing from the vault in it: window size, theme, your choices, a random install ID, the path of your copy folder if you set one, and when the update check last ran.
  • Small working files, such as the count of wrong password tries and the Windows Hello or fingerprint record.

Uninstalling the Windows app leaves the vault in place, on purpose. Uninstalling the Android app deletes the vault on that phone.

What the Android app looks at

  • Autofill, once you choose KAPEVault as the phone's autofill service: when a sign-in screen opens in another app or a browser, Android shows KAPEVault that screen's form fields and the app or website they belong to, so it can offer to fill a login. This is read on the phone, used only to fill the login you pick, and never saved, logged or sent. KAPEVault does not save logins you type into other apps.
  • The camera, only while you scan a 2FA QR code: each frame is read on the phone and dropped. No picture is saved or sent.
  • Fingerprint unlock uses Android's own fingerprint check. KAPEVault never sees your fingerprint, only whether the check passed.

What leaves your device

The apps make only these connections, and each one starts with something you switch on or tap:

  • Cloud backup and sync, once you connect a Cloudflare R2 bucket: the encrypted vault file and the Forever Opener page go to your bucket (an address ending in r2.cloudflarestorage.com), and your other devices' encrypted backups come back. Backup names hold a random install ID and the time, nothing about you.
  • Links you open: a website saved in an item opens in your own browser.
  • Air Wall Test on Windows: when you press Test, the app tries one connection to 1.1.1.1 on port 443 and sends nothing, to see whether Windows blocks it.
  • Check for updates on Windows, only if you switch it on in Settings, General: once a day the app asks api.github.com whether a newer KAPEVault is out. The request carries only the app's name and version, nothing from your vault. GitHub sees your internet address, as any website does.

Cloudflare stores your bucket under your own agreement with Cloudflare. If your copy folder is inside OneDrive, Google Drive or Dropbox, that app uploads the encrypted file under its own terms. Windows, Android and your browser follow their own policies.

This website

This site is a set of static pages. It sets no cookies, stores nothing in your browser, and runs no analytics, trackers or third-party scripts. Its fonts, images and film are served from this site.

The company that hosts the site may keep standard server logs (IP address, browser, page requested, time) for security and to keep the site running. We do not use them to identify or track you.

Your control

Everything KAPEVault stores is on your devices or in your bucket, so you can copy or delete it yourself. We hold nothing about you to hand over or erase.

Changes and contact

If this policy changes, this page and its date change with it. KAPEVault is provided by BrewedOps (Kenneth Villar) in the Philippines. Questions: kvillarmain@gmail.com.