No account. No email. No sync. Stonevault ships without network permission, so your vault stays on your phone, and part of its key never leaves the phone's secure hardware.
There is no server to breach and no telemetry to opt out of. The app is built without network permission at all. You do not have to take that on trust: it is a property of the binary, and anyone can check it.
Unlocking takes two things: your master password, and a key sealed in the phone's secure hardware. A stolen vault file is not enough. Without this exact phone, it cannot be brute-forced offline, however fast the attacker's machines are.
The first screen asks for a master password. That is the entire onboarding: no email, no account, no verification code.
Keys derive on the device and bind to its secure element. Nothing is escrowed anywhere, and nothing about you is recoverable by anyone else.
A recovery kit you actually complete, encrypted backups you export yourself, and a verifier that reads a backup end to end before you ever need it.
The entire app is public: the crypto, the storage format, the autofill service. Releases are reproducible, so you can build the source yourself and compare binaries. If a claim on this page is wrong, the code is where you prove it.
Then the data is gone, unless you saved your recovery kit. Nobody can unlock the vault for you: not the developer, not Apple or Google, not a support request. That is the cost of a vault nobody else can open, and the app says so plainly before you create one.
Restore from your backup file with your recovery code. A system transfer alone is not enough, because the hardware half of the key stays in the old phone's secure element by design.
You don't. Sync means a server, and a server means trusting someone with your account list. Stonevault has neither. Export an encrypted backup and carry it yourself.
You shouldn't have to. Check the manifest for network permission, read the source, build it yourself and compare the binaries. Every claim here is verifiable without asking us.