patchsized

accountpatch

Privacy Policy

Effective date: 21 October 2026 · Contact: support@patchsized.com

The short version

  • Everything you save stays on your phone, encrypted.
  • AccountPatch never stores passwords, one-time codes or recovery keys. It has no place to enter them.
  • The app has internet permission for one job: downloading a public, signed list of well-known apps and websites (names and sign-up links). The request carries nothing about you or your accounts, and you can switch it off in Settings.
  • Optional sync between your own phones is off until you turn it on. When on, the app saves one encrypted file in a hidden folder of your own Google Drive that only AccountPatch can open. We cannot read it.
  • We do not collect, receive, sell or share any personal data. No account with us, no ads, no analytics, no tracking, no crash reporting.

What the app stores on your device

When you use AccountPatch, the following is saved on your phone only:

  • For each account you add: the app or website name, its web address, its type (app, website, social or other), the login you used to sign up (an email address, phone number or username), how you signed up (email, Google, Apple, phone or other), whether two-step login is on and which kind, any notes you type, the date you last reviewed it, and the category, tags and profile you give it.
  • Profile names, icons and colours (for example Work, Personal, Business), plus category and tag names you create.
  • Your choices about accounts that need attention, such as dismissed or snoozed reminders.
  • Settings: theme, language, how soon the app locks, whether fingerprint or face unlock is on, whether the app list refresh is on, whether reminders are on, and whether sync is on.
  • A salted hash of your PIN, which is used to check the PIN and cannot be turned back into it. We cannot recover a forgotten PIN.
  • A copy of the app list, so names and logos work offline (see below).

Your account list is encrypted in the app's database. The key is created on your phone and kept protected by the Android Keystore. The PIN, and fingerprint or face if you turn it on, open the app. After several wrong PIN tries the app makes you wait before trying again; it does not erase anything.

Deleting an account. When you delete an account it disappears from the app straight away, but its record stays in the encrypted database on your phone as a deletion marker until you uninstall the app or clear its storage. It is not sent anywhere.

Android's own app backup and device-transfer features are turned off for the app's data, so it is not copied to Google Drive or another phone automatically. The only way your data reaches Google Drive is the optional sync described below, which you turn on yourself.

Permissions the app asks for

  • Internet: to download the app list described below and, only if you turn sync on, to talk to your own Google Drive.
  • Notifications: asked for only when you turn reminders on, so the app can tell you that some accounts need attention. A reminder shows a count, not account names, and hides its contents on the lock screen. It is created on your phone; nothing is sent anywhere.
  • Biometrics / screen lock: the app uses Android's system prompt. We never see or store your fingerprint or face data; Android handles it.

The app does not ask for camera, contacts, storage, location or microphone access. Exporting and importing files uses Android's own file picker, which gives the app only the file you choose.

The app list (the only thing downloaded)

AccountPatch includes a list of popular apps and websites so it can suggest names, show logos and link to sign-up and security-settings pages. A copy is built into the app and works offline. About once a day, the app can check patchsized.com for a newer copy of this list.

  • It is a plain request for a public file. It sends no cookies, no account data, no device identifier and nothing you have saved. The request names the app and its version, as any web request names its software.
  • Like any web request, it reaches our web host with your internet address. The host may keep ordinary server logs. We do not use them to identify you, and they contain nothing about your accounts.
  • The list is digitally signed. The app uses a downloaded list only if the signature checks out.
  • You can switch this off at any time in Settings. The app then uses the copy it already has.

Logos are built into the app. AccountPatch never fetches a logo for one of your accounts, because that would tell a server which services you use.

When data leaves your phone

Only when you start the action yourself:

  • Export: you can save your accounts as a JSON file, optionally protected by a passphrase you choose, or as a CSV spreadsheet. A CSV file is not encrypted, and a JSON file without a passphrase is not either. They contain account names, logins and notes, so keep them somewhere safe and delete them when you are done. If you lose the passphrase of an encrypted file, we cannot recover it.
  • Import: you can bring in a file you exported earlier, or a CSV exported from a password manager. From a password manager file the app reads only the site or app, the username, the folder and whether a one-time-code secret exists. It ignores passwords and notes and does not keep them. Because such a file holds passwords in plain text, delete it after importing.
  • Opening a link: when you tap a website or security-settings link, the app hands it to your browser. That site then sees your visit like any other link you open.
  • Sharing into the app: you can share a link or a name from another app to start a new account. Nothing is shown until the app is unlocked.

AccountPatch cannot see or control anything after you share or export data this way.

Home-screen widget

If you add the AccountPatch widget, it shows only a count of accounts that need attention and a button to add one. It shows no account names or logins, and it is drawn on your phone from the same data the app holds.

Optional sync

You can keep your accounts in step across your own phones in two ways. Both are off until you choose them.

  • Sync file: the app can save an encrypted sync file, protected by a passphrase you choose, and merge one from another phone. You move the file yourself, using Android's file picker.
  • Google Drive sync: if you sign in with Google and turn it on, the app keeps one encrypted sync file in your Google Drive's hidden app-data folder. It uses only Google's drive.appdata permission, which lets AccountPatch see its own folder and nothing else in your Drive, and it does not read your name, email address or any other Google account data. The app checks and updates the file in the background at regular intervals and when you open it or change something.

The file is encrypted on your phone with a key made from your passphrase before it leaves, using AES-256-GCM. The passphrase is never sent anywhere and we cannot recover it, so a lost passphrase means the file cannot be opened. The file travels between your phone and your own Google Drive; it does not pass through any server of ours, and we cannot see it. Google stores it under your Google account and its own terms and privacy policy. When you turn Drive sync off, the app stops using it, and you can delete the file from the app or from your Google Account's Drive app-data settings. Deletion markers (see above) are carried in the file so that a deleted account stays deleted on your other phones.

AccountPatch's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The app uses the Drive permission only to store and retrieve its own sync file for you, shows it to no one, and does not use it for advertising or to build profiles.

Screenshots

The app blocks screenshots and screen recording, and hides its contents in the recent-apps view.

Children

AccountPatch is not directed at children under 13, and we do not knowingly collect any information from anyone, since the app collects none.

Deleting your data

Delete accounts, profiles, categories and tags inside the app. Uninstalling the app, or clearing its storage in Android settings, removes everything it stored on your phone. Because nothing is stored by us, there is nothing else to delete. Export files you created are your own files; delete them yourself.

Changes to this policy

If the app changes how it handles data, we will update this page and the Play Store listing before that version is released, and the effective date above will change.

21 October 2026: added reminders (notifications), the home-screen widget and optional sync, including Google Drive sync. Before this, the app used no Google services and did not ask for notification access.

Contact

Questions: support@patchsized.com