Contact support
Email support@operatorapps.dev. We aim to reply within a few working days.
Include your app version (CFG › About & licences), your phone model and operating-system version, and the steps that lead to the problem.
Never send secrets
Support will never ask for your passphrase, recovery key, PINs, backups or vault contents. Do not include them in any message.
Access and recovery
I forgot my passphrase
On the lock screen, choose to unlock with your recovery key, then set a new passphrase. Without the passphrase or the recovery key, the vault cannot be opened: the encryption has no back door and the developer holds no copy of your data or keys.
I lost my recovery key
If you can still open the vault, create a new recovery key in CFG. The old key stops working. Write the new one down and keep it offline.
I forgot a PIN on an item
PINs cannot be reset or bypassed, not even with your passphrase or recovery key. An item protected by a forgotten PIN stays locked. This is deliberate: someone who learns your passphrase still cannot open PIN-protected items. If you still know the PIN, you can change or remove it at any time.
Why am I made to wait after wrong attempts?
After five wrong attempts, the app waits 30 seconds before the next one, doubling up to 15 minutes. Passphrase and PIN attempts are counted separately, and the delay survives restarting the app. It slows down anyone guessing on a stolen phone.
Backups and new phones
How do I move my vault to a new phone?
On the old phone, open CFG and make an encrypted backup (.ocbak). Move the file to the new phone in any way you like: it stays encrypted. Install Operator Crypt on the new phone and restore the backup. Your passphrase, PINs and documents come across intact.
Why is my vault not in my phone's cloud backup?
Vault data is excluded from your phone's cloud backups (Google backup and device-to-device transfer; iCloud) on purpose, so no copy of it ever reaches a cloud service you did not choose. Use encrypted backups instead, and store them where you trust.
What is the difference between a backup and a data export?
A backup stays encrypted and opens only in Operator Crypt with your passphrase. A data export is a decrypted zip (passwords as CSV and JSON, documents as their original files) for moving to another product. Treat exports as sensitive and delete them when done.
Using the app
What does duress mode do?
You can keep several vaults on one phone. If you mark one as a duress vault, opening it with its passphrase permanently destroys every other vault on the device. Only use it if you understand that this cannot be undone.
Why can't I take screenshots?
On Android, screenshots and screen recording are blocked so that vault contents cannot be captured by other apps or appear in recent-apps thumbnails. On iOS, the app switcher shows a blank screen so vault contents never appear in it.
Why does the app refuse to upload a large file?
The vault has a storage limit, set as a share of your phone's storage plus a free-space reserve, so your phone never fills up completely. You can raise the limit in CFG.
Is there cloud sync or a desktop version?
No. Operator Crypt is offline by design and has no network permission. Use encrypted backups to move data between devices.
How do I delete everything?
To delete one vault, use CFG › Destroy this vault. To delete all app data on the phone, use Erase all data on this device on the lock screen. Uninstalling the app also removes everything it stored.
Security
Which cryptography does the app use?
Argon2id (64 MiB, 3 passes) turns your passphrase into a key. Every item has its own random 256-bit key and is encrypted with AES-256-GCM; documents are encrypted in authenticated 1 MiB chunks. Optional PINs add a second layer derived with Argon2id and combined with the vault key through HKDF-SHA256. See the security model for details.
What is not protected?
A phone that is already compromised (malware, rooted or jailbroken), a weak passphrase, and decrypted copies you export or open elsewhere. The number and sizes of encrypted files on disk are visible to someone with access to the app's storage. Use a long, unique passphrase.
How do I report a vulnerability?
Email support@operatorapps.dev with "Security" in the subject and a description of the issue. Please allow time for a fix before disclosing it publicly. We aim to acknowledge reports within a few working days.