Privacy Policy — AdFree AppLock: App Locker

Last updated: 10 October 2026 · App: AdFree AppLock: App Locker (com.nomadiccharts.applock) · Published by LaunchGrid (Abhishek Maurya), Vadodara, India

1. Who we are

AdFree AppLock: App Locker ("the App") is published by LaunchGrid (Abhishek Maurya), Vadodara, India ("we", "us"). This policy explains how the App handles your information, in line with the Digital Personal Data Protection Act, 2023 (DPDP Act).

2. The short version

There is no account, no sign-up and no ads. Your lock credentials, the list of apps you lock, your vault files and your intruder photos never leave your device, and we have no server that could receive them. The App does use Google’s Firebase services for crash reports, optional usage analytics, remote settings and optional announcements; those receive limited technical data described in section 7, never any of the things above. We do not sell data or track you across other apps or websites.

3. What the App stores, on your device only

• Which apps you have chosen to lock, and your lock preferences
• Your PIN, pattern or password — stored as a salted hash, never as the value you typed
• Photos and videos you move into the vault
• Intruder photos and failed-attempt logs, if you enable that feature

4. How it is protected

• Credentials are hashed with PBKDF2-HMAC-SHA256 at 210,000 iterations with a random salt, and verified using constant-time comparison. We never store, and cannot recover, your actual PIN or password.
• Vault files and intruder photos are encrypted with AES-256-GCM, backed by the Android Keystore.
• All sensitive key-value settings use encrypted shared preferences.
• Everything sits in the App’s sandboxed private storage, protected by Android’s application isolation.

Because your credential is not recoverable, losing it means losing access to the vault. That is the trade-off of encryption that we cannot bypass either.

5. Permissions, and why each is needed

• PACKAGE_USAGE_STATS (Usage Access) — detects which app has come to the foreground so the lock screen can be shown. Without it the App cannot lock anything. It is used only for that check; no usage history is recorded or transmitted.
• SYSTEM_ALERT_WINDOW (Display over other apps) — draws the lock screen above the app being opened.
• FOREGROUND_SERVICE — keeps the protection service running so locking does not stop when the App is in the background.
• RECEIVE_BOOT_COMPLETED — restarts protection after the device reboots, so your apps are not left unlocked.
• POST_NOTIFICATIONS — shows protection status and intruder alerts.
• CAMERA (optional) — used only for the intruder selfie after a failed unlock. Photos are encrypted and stored on your device. Decline it and every other feature still works.

6. Network access

The App does not send your lock credentials, locked-app list, vault files or intruder photos to any server. Those stay on your device. Network access is used only by Google services bundled with the App:

• Google Play Billing — processes purchases and checks subscription status.
• Google Play Integrity — verifies the App was installed from Google Play.
• Google Play In-App Updates and In-App Review — checks for updates and shows Google’s rating prompt.
• Firebase Crashlytics, Analytics, Remote Config and Cloud Messaging — described in section 7.

These are operated by Google and governed by Google’s privacy policy and the Firebase privacy information. We do not receive or store your payment details.

7. Advertising, analytics and crash reports

The App contains no advertising and no advertising SDK, and it does not use the Android advertising ID (the permission is removed from the App). There is no ad-supported tier.

The App uses these Google Firebase services. None of them receives your credentials, locked-app list, vault files, intruder photos or notification content.

• Firebase Crashlytics — when the App crashes it sends the crash stack trace, the App’s state at the time, device model and OS version, and a random Crashlytics installation ID, so the crash can be fixed.
• Firebase Analytics — usage events such as which setup step was reached, whether a permission was granted, and whether the trial converted. Events carry no app names, file names or content (a count of chosen apps is sent only as a range such as “2–3”). They are identified by a random app-instance ID, not your name, email or advertising ID, and Google derives approximate location (country or city) from your connection. You can turn analytics off in Settings → Privacy.
• Firebase Remote Config — fetches app settings (for example a required minimum version). Sends country and language code, time zone, OS and app version, and a Firebase installation ID.
• Firebase Cloud Messaging — delivers optional “News and updates” notifications, using a Firebase installation ID and messaging token. You can turn announcements off in Settings.

This data is encrypted in transit, processed by Google as our service provider, and not shared with anyone else. The Data Safety section of the App’s Google Play listing declares the same data.

An earlier version of this policy described Google AdMob on a free tier; AdMob was removed from the App entirely. A later version (25 September 2026) said the App had no analytics SDK and collected no data, which was incorrect: the Firebase services above were already included. This version corrects that.

8. Your rights under the DPDP Act, 2023

• Access: everything the App holds is visible inside the App on your device.
• Erasure: delete items in the App, clear the App’s data in Android Settings, or uninstall — your vault, photos and settings are held nowhere else. Analytics and crash data are tied only to random installation IDs; clearing the App’s data or reinstalling starts new ones, and you can ask us to delete what Firebase holds by writing to the address below. See the data deletion page.
• Objection: turn off analytics and announcements in the App’s Settings at any time.
• Grievance redressal: write to grievance@launchgrid.in. We respond within 30 days.

9. Children

The App is intended for general audiences and is not directed at children. It collects only the limited technical data described in section 7, from anyone.

10. Changes to this policy

Material changes will be reflected in an updated App version with a revised "Last updated" date.

11. Contact

LaunchGrid (Abhishek Maurya), Vadodara, India — privacy@launchgrid.in · Support: support@launchgrid.in