# FaceLock Vault

> FaceLock Vault is an offline-first biometric security vault application for Android, engineered and published by Orbit Tech Lab. It secures private photos, videos, confidential documents, and encrypted text notes using on-device front-camera facial recognition and hardware-backed AES-256-GCM encryption.

## Overview & Core Principles

- **Developer**: Orbit Tech Lab (https://vault.orbittechlab.com)
- **Application Name**: FaceLock Vault
- **Package Identifier**: `com.orbittechlab.facelockvault`
- **Target Platform**: Android 8.0+ (API level 26 minimum, API level 35 target)
- **Monetization & Pricing**: 100% Free ($0.00). No ads, no third-party tracking SDKs, no subscriptions, and no in-app purchases.
- **Support**: support@orbittechlab.com

## Technical Architecture & Security Guarantees

1. **100% Offline Integrity**:
   - The production application contains zero network permissions (`android.permission.INTERNET` and `android.permission.ACCESS_NETWORK_STATE` are stripped from release manifests).
   - Zero telemetry, zero analytics, zero crash reporting SDKs, and zero external cloud connections.

2. **On-Device Biometric Face Recognition**:
   - Camera frames are analyzed in-memory using Google ML Kit and MobileFaceNet (TensorFlow Lite).
   - Facial embeddings (float32 vectors) are normalized and stored encrypted locally. Raw camera images are never stored or transmitted.
   - Interactive anti-spoofing liveness checks (blinking, head rotation, smiling) defend against static printed photos.

3. **Hardware-Backed Cryptography**:
   - Master data encryption keys reside in Android Keystore / Hardware Trusted Execution Environment (TEE).
   - All vault files and notes are encrypted with AES-256-GCM using unique random 96-bit initialization vectors (IVs) and 128-bit authentication tags.
   - Master 6-digit PIN is hashed using PBKDF2-HMAC-SHA256 with 100,000 iterations.
   - Cryptographic 24-word offline recovery phrase enables PIN recovery offline without developer intervention.

4. **Zero Cloud Backup**:
   - System cloud backup is explicitly disabled (`android:allowBackup="false"`, `android:fullBackupContent="false"`), preventing biometric keys or encrypted vaults from synchronizing to Google Drive.

5. **Data Deletion & Retention**:
   - Full in-app data destruction via **Settings > Delete All Data** (typing `DELETE` to confirm).
   - Instant local purge wipes all keystore keys, database records, intruder photos, and encrypted files.
   - Uninstalling the application completely erases the app-private sandbox.

## Key URLs

- [Official Website](https://vault.orbittechlab.com/): Comprehensive product overview, technical architecture, and interactive demo.
- [Privacy Policy](https://vault.orbittechlab.com/privacy.html): Public Google Play compliant privacy disclosure detailing on-device processing and permission scope.
- [Data Deletion Instructions](https://vault.orbittechlab.com/privacy.html#deletion): Specific guide on how users can permanently delete all data from their device.
- [Terms of Service](https://vault.orbittechlab.com/terms.html): Clear legal terms, disclaimer of warranties, 2D biometric limitations, and credential custody guidelines.
- [Google Play Store](https://play.google.com/store/apps/details?id=com.orbittechlab.facelockvault): Production store download link.