ToolVault Privacy Policy

This policy covers the ToolVault Android app, published by UnluckyTech. ToolVault finds apps that spam your device with pop-up ads by watching which apps come to the foreground, and — for Pro users — can filter ad and tracker domains at the DNS level.

The Short Version

• Your app-usage history stays on your device. We never upload your activity log, your installed-app list, or your usage history.
• We never see the websites or domains your device looks up. The DNS filter runs entirely on your phone. Nothing is routed through a server of ours, and as of version 1.7.0 the app does not even store blocked domain names locally.
• An account is optional. Everything except cross-device Pro works without one. If you create one, we hold your email address and username.
• If you report an app as adware, that single report is sent to our server, and it is about the reported app — not about you.
• The free version shows ads via Google AdMob, which involves Google collecting advertising data as described below.
• We do not track how you use the app. ToolVault contains no analytics SDK of our own. In the free version Google’s ads SDK collects ad-related data, including for analytics — see Advertising below.

Data That Stays on Your Device

To do its job, ToolVault needs Android’s Usage Access permission, which lets it see which app is in the foreground. Using it, the app records foreground sessions (app name, package, time, and duration) and flags apps that appear with suspicious frequency. It also reads your installed-app list so it can show the name and icon of any app it observes.

The DNS filter keeps a count of how many domains it blocked and in which category. It does not record which domains those were. Earlier versions kept blocked domain names for seven days; version 1.7.0 removed that entirely, and existing history was stripped of it on upgrade.

The app also keeps local counters about its own behaviour — how often the monitor woke up, how many events it processed — used only to size its battery cost. These never leave your device.

All of this is stored in a local database on your device only. It is never transmitted to us or anyone else. As of version 1.7.0 none of it is included in Android backup or device-to-device transfer, so uninstalling ToolVault genuinely deletes it and moving to a new phone starts fresh.

Data Sent Off Your Device

1. Adware reports (only if you submit one)

When you choose to report an app as an ad source, the report is sent to our server (adwatch.unluckytech.com) to help build a community-sourced list of known adware. A report contains:

• the reported app’s package name and display name,
• the report category and an optional note you write,
• the time of the report and a local reference number,
• a random, anonymous installation token generated on your device — our server stores only a salted hash of it, used solely for rate-limiting and de-duplication. It identifies an installation, not a person, and reinstalling the app resets it,
• and it may include a Google Play Integrity token, used once to check the report came from a genuine app on a genuine device.

Like any web request, a submission exposes your IP address to our server. We use it only for rate-limiting and never store it raw — only a salted, one-way hash.

Reports contain nothing about your own usage of your device. The free-text note is the one field you control entirely, so please don’t put personal information in it.

2. Downloads: the community list and the filter lists

The app periodically downloads the community adware list and, for Pro users, the DNS blocklist from our server. These are ordinary downloads — your device asks for a file and receives it. We do not learn what you then do with it. Like any web request, this exposes your IP address while the download happens.

3. Your account (optional)

You can use ToolVault without an account. If you create one, it is held by our identity service Passport (passport.unluckytech.com), and we store:

• your email address,
• a username you choose,
• a one-way hash of your password (we never store the password itself), or the fact that you sign in with Google,
• hashes of your session and verification tokens, and account timestamps,
• and which entitlements your account holds (for example, Pro).

We send email to your address for sign-in codes on a new device, password resets, email changes, and account-deletion confirmation. Delivery is handled by Brevo. An account exists so your Pro follows you to a new phone; it is not used for marketing.

4. Purchases

Pro is a monthly or yearly subscription. You can buy it either through Google Play or on our website, where payment is processed by Stripe. In both cases the payment itself is handled by that provider — we never see or store your card details. We receive confirmation that a subscription is active, the store’s reference for it, and (for website purchases) the email address you used, so the subscription can be attached to your account.

You can also earn ad-free time by watching rewarded ads. Those points are counted on your device and never leave it.

5. Advertising (Google AdMob — free version)

The free version displays ads served by Google AdMob. While ads are enabled, Google’s Mobile Ads SDK automatically collects and shares with Google:

• your advertising ID and other device identifiers,
• your approximate location, inferred from your IP address,
• ad-interaction data — how you interact with the ads themselves,
• and diagnostic data about ad delivery.

Google uses these to serve and measure ads, for analytics, and for advertising fraud prevention, as described in How Google uses information from sites or apps that use its services. This collection is Google’s, through its SDK, and none of it can be switched off individually while ads are showing — subscribing to Pro removes ads and disables the ad-serving components entirely.

One thing worth being exact about, because ToolVault also watches which apps come to the foreground: “ad-interaction data” means how you interact with the ads, not how you use your apps. Your foreground activity log is never uploaded to Google, to us, or to anyone — see Data That Stays on Your Device above.

In the European Economic Area and the UK, the app asks for your consent before showing personalized ads. You can reset or delete your advertising ID at any time in Android settings.

6. Google Play Integrity

To keep fake reports out of the community list, report submissions may include a Play Integrity verdict. This involves Google Play services collecting device and app integrity signals as described in Google’s documentation; we receive only the resulting verdict, not the underlying device data.

DNS Filtering — What It Does and Doesn’t Do

Pro includes an on-device DNS filter. Android requires it to be set up as a VPN, and you will see the VPN key icon while it runs, so it is worth being exact about what that means:

• No traffic is sent to a remote server of ours. There is no VPN server. The “VPN” is a local mechanism that lets the app answer DNS lookups on the device itself.
• Only DNS reaches the app. Everything else on your connection takes its normal route and is never visible to ToolVault.
• Lookups we don’t block are passed to your network’s own DNS server, exactly as they would be without the app.
• We do not log, store, or transmit your lookups.

It is an ad and tracker filter, not malware protection, and it has limits: apps using DNS-over-HTTPS/TLS or a hard-coded DNS server bypass it, and Android allows only one VPN at a time, so another VPN app will take the slot.

Permissions Explained

• Usage Access — to see which app is in the foreground. Core function; the data stays on your device.
• Query all packages — to resolve the name and icon of any app the monitor observes, since adware can be any installed app. Used on-device only.
• Foreground service & notifications — to keep monitoring while the app is in the background and show the status notification.
• VPN — for the on-device DNS filter described above (Pro, optional).
• Request delete packages — so the Uninstall button can open Android’s own uninstall dialog. You always confirm; the app cannot remove anything by itself.
• Run at startup — to resume monitoring after a reboot, if you had it enabled.
• Internet & network state — for ads, list downloads, report submission, and account sign-in.

Data Retention & Deletion

On your device: the activity log and block counts roll off after seven days, and everything local is deleted when you uninstall the app or clear its storage.

Your account: delete it from Settings → your account → Delete account, or on the web at unluckytech.com/delete-account — no app install required. We email a code to confirm it’s you. Deletion removes your email address, username, password hash, sessions and entitlements. Cancel a Google Play subscription through Google Play; we cannot cancel it for you.

Adware reports: retained to maintain the community list — that is what makes the detection useful over time. They are not linked to your account.

Abuse-prevention data (hashed IPs, hashed installation tokens, rate-limit counters) is kept only as long as it is useful for that purpose.

Who Else Processes This Data

We use a small number of providers, each for one job: Google (Play Billing, AdMob, Play Integrity, Google sign-in), Stripe (website payments), Brevo (sending account email), Cloudflare (serving and protecting our endpoints), DigitalOcean (hosting), and Backblaze (encrypted off-site backups of our server databases). We do not sell your data, and we do not share it for advertising beyond what AdMob does as described above.

Children

ToolVault is not directed at children under 13, and we do not knowingly collect personal information from children.

Changes

If this policy changes, the effective date above will be updated. Material changes will be noted in the app’s release notes.

Contact

Privacy questions: [email protected]
See also the unluckytech.com website privacy policy.