AstraVault User Guide
Everything you need to store, access, and protect your documents — from first launch to advanced features.
Installation & Sign-In
Download from Google Play
AstraVault is available free on Google Play for Android 8.0 (API 26) and above, on arm64-v8a devices (all modern Android phones).
- Open Google Play StoreSearch for "AstraVault" or follow the link on our website.
- Tap InstallThe app is free to download. No payment required at install time.
- Open AstraVaultAfter install, tap Open or find AstraVault in your app drawer.
- Sign in with GoogleTap "Sign in with Google" and choose the Google account you want linked to your vault. This account also determines which Google Drive folder stores your encrypted documents.
Splash Screen
Vault Setup
On your first launch (after sign-in), AstraVault asks you to set a vault passphrase — the single key that unlocks all your encrypted documents. This is a one-time process on each device.
Set Your Vault Passphrase
On first launch, choose a strong passphrase of at least 8 characters. This is your master key — AstraVault cannot recover it for you. Write it down and store it offline.
The app shows a strength indicator as you type. A strong passphrase has uppercase, lowercase, digits, and symbols. After entering it twice to confirm, the passphrase is stored securely in Android's EncryptedSharedPreferences on your device only — it is never transmitted.
On a new device (reinstall), enter the same passphrase you used previously to restore your vault access. Your encrypted documents sync back from Google Drive automatically after unlock.
Passphrase Setup
Unlocking the Vault
Every time you open AstraVault, the app locks automatically when you background it. Unlock is fast — typically a single fingerprint tap.
The Unlock Sequence
- App Opens → Integrity CheckThe app verifies it hasn't been tampered with (signature check, root detection). On a clean device this takes under a second and is invisible.
- Biometric PromptYour device's fingerprint prompt appears. Authenticate with your fingerprint. If biometrics fail or are unavailable, enter your vault passphrase instead.
- Vault DecryptionThe SQLCipher database opens. Your documents are now accessible.
Status Messages
While the vault is loading you'll see status text below the spinner. These are normal:
| Message | What it means |
|---|---|
| Checking your session… | Verifying your Firebase auth token |
| Refreshing security token… | Silently refreshing the session (capped at 2s) |
| Waiting for vault unlock… | SQLCipher key derivation in progress (PBKDF2) |
| Vault ready… | Database open, navigating to Home |
Scanning Documents
The 4-Gate Camera
Tap the blue camera FAB on the Home screen to open the document scanner. Before a capture is accepted, all four quality gates must show green:
| Gate | What it checks | Fix |
|---|---|---|
| 🔲 Blur | Image sharpness — motion or camera blur | Hold the phone steady |
| 💡 Light | Scene luminance — too dark or washed out | Move to better lighting |
| 📐 Stability | Gyroscope — phone is shaking | Brace your elbows |
| 📏 Angle | Aspect ratio — document fills the frame | Move closer / rotate |
When all gates are green, the shutter button becomes active and the capture is accepted automatically (or tap to capture manually).
After Capture — OCR Pre-fill
The captured image is immediately run through ML Kit OCR (English + Hindi). The extracted text is used to:
- Pre-fill the document name field with a suggested name
- Auto-select the most likely category (from 18 categories)
- Extract and display the document date
- Mask sensitive ID numbers before any storage occurs
Review the pre-filled fields, adjust if needed, then tap Save.
4-Gate Camera
Importing Files
Alongside the camera FAB, there is a smaller upload icon (↑) above it. Tap it to import existing files from your device:
- Images: JPEG, PNG, WebP — scanned with OCR
- PDFs: Processed directly without OCR pre-fill
You can select multiple files at once. Each file goes through the same Save Document screen where you can edit metadata before saving. Multiple files are queued and processed one at a time.
Vault Inventory
Reading the Document List
The Home screen shows all your documents sorted by most recently added. Each card shows:
| Element | Description |
|---|---|
| Identity › ID Documents | Category and subcategory in blue text |
| Encrypted · 1.23 MB | Always encrypted — size of the ciphertext |
| Added: 12 Jan 2026 | Date the document was added to the vault |
| ✓ Cloud | Sync status: SYNCED / SYNCING / PENDING / FAILED |
| 📌 Pin icon | Pin important documents to keep them at the top |
Sync Status Badges
The small badge in the bottom-right corner of each document icon shows its Drive sync status:
- ✓ Green — Synced to Google Drive
- ↻ Blue — Sync in progress
- ⏱ Amber — Waiting to sync (queued)
- ✕ Red — Sync failed — tap to retry
Long-Press Context Menu
Long-press any document card to open a context menu with:
- Edit Metadata — rename, change category, update date
- Pin / Unpin — keep at top of list
- Open — view in Zero-Trace viewer
- Delete — soft-delete (moved to trash, permanent after 30 days)
Vault Inventory
Document Limit & Capacity
The Standard (free) tier includes 25 documents. When you approach 80% capacity a warning bar appears at the top. When full, you can:
- Watch an optional ad to unlock +5 extra document slots for today
- Upgrade to Pro for unlimited documents
Viewing Documents
Tap any document card to open its detail screen. From there, tap View Document to open the Zero-Trace viewer.
Zero-Trace Viewer
The viewer decrypts the document entirely in RAM — nothing is written to your phone's storage during viewing. The decrypted bytes are displayed, then zeroed from memory when you close the viewer. There is no temp file, no cache, no screenshot history.
Document Detail Actions
| Action | What it does |
|---|---|
| 📌 Pin | Pin / unpin to keep at top of vault inventory |
| ✏️ Edit | Change name, category, subcategory, date, or remarks |
| 👁 View | Open in Zero-Trace RAM viewer |
| 📤 Share | Export decrypted file — optionally password-protected |
| 🗑 Delete | Soft-delete (30-day trash period before permanent removal) |
Editing Metadata
Metadata (name, category, subcategory, document date, remarks) can be changed at any time without re-uploading the document. Long-press a card and tap Edit Metadata, or tap the edit icon inside the document detail screen.
Changes are saved locally and queued for sync to Drive metadata. The encrypted document file itself is not re-uploaded on metadata changes.
18 Document Categories
| Category | Example Subcategories |
|---|---|
| Identity | National ID, PAN, Passport, Voter ID, Driving Licence |
| Financial | Bank Statements, Tax Returns, Investment Certificates |
| Medical | Prescriptions, Reports, Insurance, Vaccination |
| Legal | Agreements, Affidavits, Court Orders, Property Deeds |
| Vehicle | RC Book, Insurance, PUC, Service Records |
| Property | Sale Deed, Rent Agreement, Khata, Encumbrance |
| Education | Degree, Marksheets, Certificates, Transcripts |
| Employment | Offer Letter, Payslips, Relieving Letter, PF |
| …and 10 more: Insurance, Utility, Family, Travel, Business, Agriculture, Social Security, Personal | |
Custom categories can be added in Settings → Manage Categories.
Search
Tap the 🔍 search icon in the top bar to open the search screen. AstraVault uses BM25 full-text search — the same algorithm used by SQLite FTS and search engines — against the OCR text snippets stored in the local encrypted database.
What search can find
- Words from the document's OCR text (up to 500 characters stored per document)
- Document names and categories
- Remarks you've added
- Extracted entities like PAN numbers (stored masked) and IFSC codes
Sync Status
How Sync Works
AstraVault syncs to your private Google Drive folder using a background queue. Every document save, edit, or delete is added to a sync queue. The SyncWorker runs every 45 minutes, or is triggered immediately after a save.
Sync Intelligence Panel
Go to Settings → Sync Status to see:
- Vault Backup Status — "ALL SYNCED" (green) or "N PENDING" (amber)
- A progress bar showing what fraction of your documents are backed up
- TOTAL / PENDING / SYNCED counts
- A "Synchronize Vault" button to trigger an immediate sync
- Your Google Drive storage usage
Sync over Mobile Data
By default, sync runs on Wi-Fi only. Toggle Sync over Mobile Data in Settings to allow syncing on cellular when Wi-Fi is unavailable.
Ad Boosts
Standard users have a daily sync slot limit. Watch an optional 30-second ad to unlock +5 document slots for the rest of the day. Tap the "Boost" button that appears in the upgrade dialog when your limit is reached.
Sync Status
Custom Categories
Go to Settings → Organization → Manage Categories to add, rename, or reorder your document categories and subcategories.
- All 18 built-in categories are available by default
- You can add custom categories for your specific needs (e.g., "Farm Documents", "Club Membership")
- Custom subcategories can be added under any category
- Deleting a category does not delete documents — it moves them to "Uncategorized"
Security Audit Trail
Go to Settings → Security & Recovery → Security Audit Trail to view a log of security-relevant events in your vault.
The audit trail shows WARNING and CRITICAL events — not routine sync or info-level events. Events include:
- Failed authentication attempts
- Document deletions
- Admin actions (if any)
- Integrity check failures
- Remote wipe commands received
The audit log is stored locally in the encrypted SQLCipher database and is not transmitted to any server.
Pro Upgrade
What's Included
AstraVault Pro is a one-time purchase of ₹499 (incl. 18% GST). No subscription. No recurring fee. Pay once, use forever.
| Feature | Standard | Pro |
|---|---|---|
| Documents | 25 | Unlimited |
| Ad Boosts (+5 slots) | ✓ | ✓ |
| Security Audit Trail | – | ✓ |
| Priority Drive sync | – | ✓ |
| Full-text BM25 search | ✓ | ✓ |
| Lifetime updates | ✓ | ✓ |
How to Upgrade
- Open the Upgrade screenIt appears automatically when you hit your document limit, or navigate to it via the Settings screen.
- Tap "Upgrade Now ₹499"The Google Play purchase sheet opens. Complete the payment.
- Instant activationPro tier is activated immediately after purchase. No restart required.
Upgrade to Pro
Vault Recovery
Restoring on a New Device
- Install AstraVaultDownload from Google Play on the new device.
- Sign in with the same Google accountThe app detects your existing vault on Drive.
- Enter your passphraseEnter the same passphrase you set on your previous device. This establishes your vault access on this device.
- Sync downloads your documentsThe SyncWorker fetches your encrypted documents from Drive and restores them to the local database automatically.
Forgotten Passphrase
AstraVault is zero-knowledge — if you forget your passphrase, no one can recover your vault. There is no reset. Write your passphrase down and store it offline in a safe place.
Lost or Stolen Device
If your device is lost or stolen, your documents are still safe because:
- The vault requires your passphrase (or fingerprint, which is hardware-bound) to open
- The SQLCipher database is encrypted with a 600K PBKDF2-derived key
- Your Google Drive copy is AES-256-GCM encrypted and inaccessible without the key
For a remote wipe of the local secrets database from the compromised device, contact info@astravault.co.in with your registered Google account email.
Deleting Your Account
Go to Settings → Privacy & Account → Delete My Account. This is a four-step irreversible process:
- Identity confirmationRe-authenticate with your passphrase.
- Review what will be deletedA summary of all data held by AstraVault.
- Delete from cloudFirestore metadata, Firebase identity, and all remote records are deleted.
- Wipe local vaultThe SQLCipher database, EncryptedSharedPreferences, Keystore entries, and local files are wiped. The app returns to the first-launch state.