Barca Labs

How your data is protected

The specifics, for people who want them — including what this protection does not cover.

The encryption

Component	Implementation
Database	SQLCipher, via the `expo-sqlite` config plugin. The database file is ciphertext at rest.
Key derivation	PBKDF2-HMAC-SHA256 at 310,000 iterations, derived directly from the PIN you set.
Salt storage	`expo-secure-store` — the Keychain on iOS, the Keystore on Android.
Biometric unlock	Generates no separate key material. It gates access to the same PIN-derived key behind `requireAuthentication`.

The key is derived on your device and never leaves it. We hold no copy of it and no copy of your data. If you forget your PIN, we cannot reset it, and your records cannot be recovered. That follows from the design rather than being an oversight — plan your own backups accordingly. There is a second reason to keep your own copy, and it is not about encryption: see the defect described below.

Biometric unlock is a faster route to the same key, not a second way in. If someone has your PIN, biometrics do not add a second lock. If they have neither, the database is unreadable ciphertext.

A defect we have not fixed

Sovereign Vault stores your records in SQLite, the database engine underneath most of the apps on your phone. SQLite has a flaw in the way it writes to disk. It has been there since 2010 and was corrected upstream in March 2026 — subtle enough to go unnoticed for sixteen years. The library we build on has not picked up that correction, and there is no version we can ship today that has it.

It can cause a recently saved entry to be lost. Silently — no error, no warning, it is simply not there.

How often depends on how an app uses the database, and we are still working out how much our own use increases the risk. We would rather tell you that than give you a number we cannot stand behind.

Most apps carrying this same defect keep a copy of your data on their servers, so a lost write is recoverable there. We do not, by design. The defect is ordinary. The consequence here is not — and that is the honest cost of an app with no server, stated plainly rather than left for you to discover.

What it means for you: copy your record out from time to time and keep it somewhere. That is the only protection available today, and it is the reason the export exists. We will change this section when the fix reaches us.

What this does not protect against

Encryption at rest solves one problem well and several others not at all. Rather than let the phrase imply more than it delivers:

Device backups — there are two different things in play. The key material in your device's secure storage (the Keychain on iOS, the Keystore on Android) behaves one way: on iOS it carries into an encrypted iCloud or computer backup and can be restored to a new device; on Android it is excluded from cloud backups and device transfers. On both platforms it stays out of unencrypted local backups.
The recovery file is different, and that one is our choice rather than the platform's. If you set up a recovery code, the app writes a small file that your code unlocks. It is an ordinary file in the app's storage, so it is included in device backups on both platforms. We did not exclude it and we could have — because a recovery code that cannot travel to a new phone would only ever work on the device that never needed it. The cost of that is real and you should weigh it: someone holding both your backup and your recovery code could open your vault. Keep the code somewhere your backups do not reach.
An unlocked device in someone else's hands. With your phone and your PIN or biometric, the app shows them your records exactly as it shows you. No encryption scheme helps here.
A jailbroken or rooted device. Keychain and Keystore isolation can potentially be defeated where the operating system's protections have been removed.
Anything you export. Once a copy leaves the app it is governed by wherever you put it. See below.

What leaves the device

The app makes a small number of network requests and none of them carry your records. Each one is described in full, including what it sends and why, in the privacy policy.

We run no server. There is no account, no sync service, and no infrastructure of ours holding a copy — which also means there is nothing of yours for us to lose, sell, or be compelled to produce.

Exports

The app can copy your record out as text — JSON or Markdown — onto your device's clipboard. No file is written and nothing is shared through the operating system's share sheet.

Once you place it somewhere else — an AI assistant, an email, a cloud drive, a printout — that copy is governed by whatever you put it into, and it is outside our reach entirely. Nothing we do protects a copy you have handed to someone else. That is the trade for being able to take your data anywhere you want it.