AVault
arpanjot-coding/AVaultReviewed by AI
Radar found strong risk signals in this project. It stays visible so you can read the evidence, but it is left out of rankings and recommendations.
What it does
An Android 12 to 16 app that records both sides of a phone call and stores each recording in an encrypted file only the app can open, behind your fingerprint or a PIN. It can delete old recordings automatically and keep the ones you bookmark. To record it needs the separate Shizuku app, which gives it system-level permission after you turn on developer options and pair it on the phone. There is no desktop version and no Play Store listing: you install an APK file from the releases page, or build it yourself.
How easy it is to install
D · terminal, several tools or a specific graphics card
It is an Android-only app, so no desktop system gets a grade. On the phone you have to install an APK by hand from GitHub, then install Shizuku, turn on developer options and wireless debugging, pair it with a code and authorize the app; the README's recommended alternative is having an AI assistant compile the project for you.
Coming soon: install in 1 click with the RepoPicks app.
Numbers on GitHub
- Stars
- 498on Nov 1, 2026
- Downloads
- —all releases
- Growth
- +2,706stars per week, est.
Stars over time
No star history yet.
Facts
- Runs on
- —
- You need to install
- Other tools
- Disk space
- not determined
- Accounts or keys
- None
- Cost
- Free · Free and open source; the Shizuku app it needs is free too.
- License
- MIT (Permissive)
- Can replace
- Cube ACR
- Last update
- Nov 1, 2026
Risk signals (7)
- Highhides that the call is being recorded
Description: "AVault - Call Recorder (No Root Required) | Privacy-first, hardware-encrypted audio vault for Android 12-16+. Rootless call recording via Shizuku"; README: it captures "both local microphone audio (uplink) and the remote caller voice (downlink)". Under "Stealth Mode & Anti-Screen Scraping", README.md says it "Suppresses intrusive terminology like \"Recording Call\". Notifications display minimal, ambiguous terminology: \"Started\", \"Saved\", or \"AVault Active\"" and that "On-screen toast notifications upon call completion are silenced". The project itself names the rules involved: the LICENSE file warns about "Violations of national, federal, state, provincial, or international telecommunications and wiretapping laws (including single-party or all-party consent statutes)", and README.md says jurisdictions "may enforce one-party consent (e.g., 18 U.S.C. § 2511 in the United States) or all-party consent (e.g., California Penal Code § 632, Germany StGB § 201, and GDPR Article 6)".
AI review
- Attentioncall recording laws vary by country
The LICENSE file itself warns about "Violations of national, federal, state, provincial, or international telecommunications and wiretapping laws (including single-party or all-party consent statutes)" and the README names "California Penal Code § 632, Germany StGB § 201". Recording a call without telling the other person is a crime in several countries and some US states.
AI review
- Attentionstealth features hide the recording
The README describes "Stealth Mode": it "Suppresses intrusive terminology like 'Recording Call'", shows "minimal, ambiguous terminology: \"Started\", \"Saved\"", silences toasts, and blocks screenshots with FLAG_SECURE. These features make a recording harder for anyone looking at the phone to notice.
AI review
- Attentiononly a debug build is offered
The only download in release v2.0.0 is `AVault-v2.0.0-debug.apk`, a debug build; the README puts release signing under the developer build steps ("Configure signing credentials in keystore.properties").
AI review
- Infoneeds system level permission through shizuku
The README says AVault "relies on Shizuku" for `android.permission.CAPTURE_AUDIO_OUTPUT` and `android.permission.MANAGE_ONGOING_CALLS`, binding to a daemon "Running under UID 2000 'shell'" — the app then works with the same privileges as a computer connected by ADB.
AI review
- Infolicense file adds a research only clause
GitHub reports no standard license (NOASSERTION) because the LICENSE file is the MIT text plus a block headed "CRITICAL DISCLAIMER FOR EDUCATIONAL & SECURITY RESEARCH PURPOSES ONLY", saying the software is "strictly for academic, educational, cryptographic, and security research purposes".
AI review
- Infostrong security claims in a brand new project
The repository was created on 2026-10-31 with one release, yet the README presents a full threat model and claims hardware-backed AES-256-GCM, "zero plaintext" playback and "Secure Shred". None of it has been checked by anyone outside the project.
AI review
Evidence is shown in its original language.
What Radar could not check
- Whether the encryption and the "no plaintext on disk" behaviour work as the README describes.
- Whether the other person's voice is actually captured, which depends on your phone brand, carrier and Android version.
- Whether the APK offered for download was built from this source code, as it is unsigned for release and has no checksum.
- Whether recordings survive an app update or reinstall, since the README says the key is tied to the app's install.
- Whether the app sends anything out from the phone, as there is no description of its network use.