Privacy Policy
Last updated: October 2026
Summary
Arcanum does not collect, transmit, or share any of your personal data. The app works entirely offline and has no internet permission. Everything you create stays on your device, encrypted, under your control.
What Arcanum Does NOT Do
- ✕ Arcanum does not Require internet access
- ✕ Arcanum does not Collect analytics or usage statistics
- ✕ Arcanum does not Use crash reporting or telemetry services
- ✕ Arcanum does not Contain advertising or third-party trackers
- ✕ Arcanum does not Transmit your files, passwords, or metadata anywhere
- ✕ Arcanum does not Access your contacts, location, or other apps' data
Data Stored On Your Device
All data created and used by Arcanum remains exclusively on your device:
Encrypted vault files
VeraCrypt-compatible containers (e.g. .hc or any extension you choose): stored where you choose, never transmitted.
App PIN
Used to unlock Arcanum: stored as a SHA-256 hash in Android's EncryptedSharedPreferences (AES-256-GCM, Keystore-backed). The raw PIN is never stored.
Container passwords
Never stored on disk. They exist only in memory during an active mount session. If you enable biometric unlock for a vault, the password is encrypted with a Keystore-backed biometric key — still never leaving your device.
Biometric credentials
Managed entirely by Android's Keystore system. Arcanum never has access to your raw biometric data (fingerprint, face), only to Keystore-backed cryptographic keys.
App settings and preferences
Stored locally via Android DataStore.
Vault metadata
Names, paths, last-mounted times: stored locally in a standard SQLite database (via Android Room). This database is not encrypted at rest, but it contains only metadata — the actual file content always remains inside VeraCrypt-encrypted containers.
None of the above is ever transmitted to us or any third party, because Arcanum has no network connectivity at all.
Privacy-Protective Features
Arcanum is built with privacy as a first principle, beyond just encryption:
Screenshot protection
Arcanum sets the FLAG_SECURE window flag, which prevents the OS and third-party screen recorders from capturing the app's contents. The app will appear blank in the system recents screen.
Calculator disguise
Arcanum can disguise itself on your home screen and in the app drawer as a plain calculator. The real app is only accessible by entering your PIN in the calculator interface.
Panic PIN
A second PIN can be configured to trigger an emergency action (panic wipe) instead of opening the app.
Permissions Explained
Arcanum requests only the permissions necessary for its core functionality:
| Permission | Purpose |
|---|---|
| CAMERA (optional) | To take photos inside the app, from Files, New, Photo. A photo goes from the camera straight into the open vault and is never saved anywhere else on the device. Asked for the first time you use it; a device without a camera never asks. |
| READ_EXTERNAL_STORAGE WRITE_EXTERNAL_STORAGE | On older Android versions only (reading up to Android 12, writing up to Android 10), to read the files you import and write the files you export. Newer versions give the app access to one file or folder at a time, through the system picker, and Arcanum asks for no storage permission there. |
| ACCESS_MEDIA_LOCATION | So that a photo you import keeps the place it was taken, which Android otherwise strips from the copy it hands over. This is not access to your device's location. The coordinates stay in the photo, inside the vault, and go nowhere else. |
| USE_BIOMETRIC USE_FINGERPRINT | To unlock the app and your vaults using your device's biometric hardware (optional). |
| FOREGROUND_SERVICE _DATA_SYNC | To run the container creation process as a foreground service, ensuring it completes reliably even when the app is in the background. No data is transmitted. |
| FOREGROUND_SERVICE _MEDIA_PLAYBACK | To keep music playing while the app is in the background, with its controls in the notification. |
| FOREGROUND_SERVICE _SPECIAL_USE | Only when you turn on Keep vaults open in the background: it keeps the app in memory while a vault is open, so Android does not close it and the vault with it. |
| RECEIVE_BOOT_COMPLETED WAKE_LOCK | Added by Android's WorkManager library, which Arcanum uses for one job: so that a panic mode wipe runs to the end even if the app is closed, and is picked up again if the device restarts before it is done. |
| usb.host (optional) | To allow storing vaults on external USB drives or SD cards connected via OTG. |
Arcanum does not request internet, location, contacts, microphone, or any permission unrelated to local file encryption.
Google Play
The Google Play version has every feature the F-Droid and GitHub versions have, and no in-app purchases. Like them, it collects nothing.
Installing an app from Google Play is handled by Google. What Google records about the download and your Google account is covered by Google's Privacy Policy, not by this page.
Open Source
Arcanum is open source. You can review the complete source code at:
github.com/Esdex/ArcanumWe encourage security researchers and privacy-conscious users to audit the code themselves rather than simply trusting this policy.
Children's Privacy
Arcanum does not knowingly collect any data from anyone, including children, because it does not collect data from anyone at all.
Changes to This Policy
If this policy ever changes (for example, if a future feature requires network access), we will update this page and clearly note the change, along with the date of the update.
Contact
Questions about this Privacy Policy can be raised via GitHub Issues:
github.com/Esdex/Arcanum/issues