Thank you for using KeyAn (“the App”). By using the App, you acknowledge that you have read this Privacy Policy. If you do not agree with it, please stop using the App.
1. Scope
This Privacy Policy applies to the KeyAn application. Third-party websites, services, and applications that you access through the App are governed by their own privacy policies.
2. Information Processed by the App
Depending on the features you use, the App may process the following information on your device:
- Vault data, including accounts, usernames, passwords, website addresses, notes, custom fields, tags, and categories;
- Authentication data, including TOTP secrets and passkey-related credentials;
- Other content you choose to save, including secure notes, payment card information, identity information, and attachments;
- App settings, including auto-lock timing, clipboard-clearing timing, biometric preferences, backup and export settings, and privacy and security preferences;
- Content you choose to import, scan, or capture, including imported files, QR codes, and images used for text recognition;
- Purchase status returned by Google Play, including product availability, purchase state, and entitlement state. The App does not receive your full payment card number or payment-account credentials.
You provide or select this information voluntarily. The App does not require a real name, home address, or other identity information unrelated to its core functions.
3. How Information Is Stored and Used
3.1 Local-First and Encrypted Storage
Your vault data is stored locally on your device by default and protected using encryption. The App uses it to provide password storage and retrieval, autofill, passkeys, one-time passwords, categories, backup, and recovery.
Unless you intentionally use export, sharing, local-network pairing, breach checking, or another feature that clearly requires a network connection, the App does not intentionally upload plaintext vault contents to a developer-operated server.
Please protect your master password. The developer cannot read or recover it and cannot decrypt a vault to which you have lost access.
3.2 Autofill and Credential Services
If you enable Android Autofill or credential-provider features, the App may identify candidate credentials for the current application or website. A selected credential is returned to the requesting application or website only after you unlock the vault and make a selection. Confirm that the destination is trustworthy before submitting credentials.
3.3 Biometric Authentication
If you enable fingerprint, facial, or another biometric authentication method, the App uses the operating system’s biometric authentication and secure key-storage services. The App does not receive, store, or upload raw fingerprints, facial templates, or other raw biometric data. The operating system returns only the required authentication result.
3.4 Clipboard
When you copy a password, one-time code, or other sensitive value, it is placed on the system clipboard. The App can clear relevant clipboard content after your selected interval. Other applications, keyboards, or system services may still read clipboard content before it is cleared.
3.5 Camera, QR Codes, Files, and Text Recognition
The App requests camera or file access only when you intentionally use QR scanning, image capture, text recognition, importing, exporting, backup, recovery, or attachments. Selected content is used to complete the action you initiated. You may revoke permissions in system settings, but related features may then stop working.
3.6 Local-Network Pairing and Transfer
When you use device pairing or local-network transfer, devices may exchange one-time pairing information, device identity public keys, and data you choose to transfer over the same local network. This does not require a developer-operated cloud account. Network operators or local devices may observe connection metadata, while vault content is intended to be protected by the App’s encrypted transfer mechanism.
3.7 Password Breach Checking
Only after you provide consent and initiate a breach check does the App connect to the Have I Been Pwned (“HIBP”) Pwned Passwords service. The App uses a k-anonymity query and sends only the first five characters of a password’s SHA-1 hash—not the original password or complete hash. HIBP may still receive ordinary network information such as your IP address and request time.
3.8 In-App Purchases
Google Play Billing processes purchases of Pro or other paid entitlements. Google may process Google Account, device, transaction, and payment information under its own policies. The App receives only the information needed to confirm product availability, purchase state, and entitlement, not your complete payment-card details.
3.9 Backup, Export, and Sharing
Backups, plaintext exports, attachment exports, and system sharing are initiated by you. A file that leaves the App’s encrypted environment may no longer be protected by the App. Prefer encrypted backups and trusted storage locations.
4. Third-Party Services
The App may connect to the following services when you use the relevant features:
- Google Play and Google Play Billing for distribution, updates, purchases, and entitlement verification;
- Have I Been Pwned – Pwned Passwords for breach checks you initiate after providing consent;
- Operating-system services for biometric authentication, secure key storage, file selection, camera, clipboard, autofill, and credential management.
The App currently does not integrate third-party advertising services and does not sell or rent your vault data for advertising profiles.
5. Permissions
Depending on your device and selected features, the App may request:
- Biometric authentication access to unlock your vault;
- Camera access for QR scanning, image capture, or text recognition;
- File or media access for importing, exporting, backup, recovery, and attachments;
- Network access for Google Play Billing, breach checks you initiate, and local-network communication;
- Autofill or credential-service authorization to provide a credential to an application or website you select.
Denying a permission does not affect features that do not depend on it.
6. Data Retention and Deletion
Vault data and settings generally remain on your device until you delete entries, empty the trash where available, reset the App’s data, or uninstall the App. Some platform backup behavior may be controlled by your operating system or device manufacturer.
Copies that you exported, shared, or stored elsewhere must be deleted separately. Because the developer does not ordinarily possess a copy of your local vault, the developer generally cannot access, correct, or delete local vault data on your behalf.
7. Security
The App uses measures such as local encryption, master-password protection, biometric authentication, automatic locking, automatic clipboard clearing, and encrypted transfer to reduce security risks. No application, device, or transmission method can guarantee absolute security. Use a strong master password, enable device screen locking, keep software updated, and avoid storing important credentials on rooted, jailbroken, or untrusted devices.
8. Children’s Privacy
The App is intended for general users who need to manage personal credentials and is not specifically directed to children. We do not knowingly collect children’s vault contents through a developer-operated server. A parent or guardian with concerns may contact us below.
9. International Processing
Your vault is stored locally by default. If you use Google Play, HIBP, or another third-party network service, connection information may be processed in regions where that provider operates, as described in its privacy policy.
10. Changes to This Privacy Policy
We may update this policy when the App’s features, data practices, or applicable requirements change. The revised policy will appear here with a new “Last Updated” date. When reasonably practicable, material changes will also be identified in the App, release notes, or on this page.
11. Contact Us
For privacy questions, contact the developer through the KeyAn Privacy GitHub Issues page.