KeyKeyKey keychain privacy policy
Privacy Policy
KeyKeyKey — Credential & Secret Manager Effective Date: March 30, 2026 Last Updated: October 3, 2026
Overview
KeyKeyKey is a local-first, zero-knowledge credential manager. Your vault data is encrypted on your device before it is stored or transmitted anywhere. We have no ability to access your passwords, cards, or notes.
Data We Collect
Data You Provide
| Data Type | Examples | Encrypted | Stored Where |
|---|---|---|---|
| Vault items | Credentials, payment cards, secure notes | Yes (XChaCha20-Poly1305) | On your device |
| Master password | Used to derive encryption keys | Never stored | Derived in memory, then discarded |
| PIN | Optional quick-unlock method | Hashed (Argon2id) | Device secure storage |
| Sync configuration | WebDAV server credentials | Yes (encrypted with your DEK) | Device secure storage |
Data We Do NOT Collect
- Analytics or telemetry
- Crash reports
- Usage statistics or behavioral data
- Device fingerprints or advertising identifiers
- Location data
- Contact lists or personal files
- Biometric templates (handled entirely by your device OS)
We do not operate servers that receive your data. KeyKeyKey has no backend infrastructure. There is no account to create and no data transmitted to us.
The one exception to "nothing leaves your device except your own encrypted sync" is Google's on-device QR scanner on Android — see QR Code Scanning (Android).
Encryption
All vault data is encrypted using envelope encryption:
- Your master password is processed through Argon2id (OWASP-recommended key derivation) to produce a Key Encryption Key (KEK).
- The KEK encrypts/decrypts a randomly generated Data Encryption Key (DEK).
- The DEK encrypts each vault item individually using XChaCha20-Poly1305 with a unique 24-byte random nonce per item.
Encryption keys never leave your device. We cannot decrypt your data, and neither can any cloud provider you use for sync.
Cloud Sync (Optional)
Sync is entirely optional and user-configured. If you enable sync, your vault syncs to a WebDAV server you control (e.g., Nextcloud, ownCloud).
What is transmitted
Only encrypted blobs of your vault are uploaded to your WebDAV server. Your server receives opaque ciphertext — it cannot read your vault contents. No unencrypted vault data ever leaves your device.
To sign in to your server, the app also sends the WebDAV username and password you entered (your username is often your email address) to that server, over HTTPS, as standard HTTP authentication. These login details go only to the server you configure; we never receive them. They are stored on your device encrypted with your vault key, and are removed when you disconnect sync.
Autofill Service
KeyKeyKey can act as an autofill provider on Android. When you select a credential from the autofill prompt, the app decrypts and provides that credential to the requesting app or website. This happens locally on your device — no data is sent externally.
QR Code Scanning (Android)
To add a 2FA (TOTP) code by scanning a QR code, the Android app uses Google ML Kit barcode scanning, which is bundled with the camera library. QR codes are decoded entirely on your device — camera images and the decoded 2FA secret are never sent anywhere.
When the scanner is used, ML Kit sends Google limited diagnostic and usage data (device model, manufacturer and OS version, app package name and version, a per-installation identifier that is not intended to identify you or your device, API configuration, and performance/error events) to help Google maintain the SDK. This data does not include your vault contents, camera images or QR code contents, is encrypted in transit, and is governed by Google's privacy policy and the ML Kit data disclosure. We do not receive it. If you prefer, you can enter 2FA secrets manually instead of scanning.
Clipboard Access
When you copy a password, it is automatically cleared from the clipboard after 30 seconds. Clipboard access only occurs in response to an explicit user action (tapping a copy button).
Biometric Authentication
Biometric unlock (fingerprint, face recognition) is handled entirely by your device's operating system (Android BiometricPrompt / iOS Secure Enclave). KeyKeyKey never accesses, processes, or stores biometric data. The encrypted vault key is stored in the OS secure enclave and is only released after successful biometric verification by the OS.
Permissions
Android
| Permission | Purpose |
|---|---|
BIND_AUTOFILL_SERVICE | Provide autofill credentials to apps and websites |
| Secure storage | Store encryption keys in Android Keystore |
| Biometric | Authenticate via fingerprint or face for vault unlock |
| Camera | Scan 2FA QR codes (only while the scanner is open) |
| Internet | Cloud sync (when configured) and ML Kit diagnostics |
Browser Extension
| Permission | Purpose |
|---|---|
storage | Store encrypted vault data locally |
activeTab | Detect login forms on the current page |
alarms | Schedule clipboard clearing after 30 seconds |
host_permissions | Inject autofill UI on web pages |
Third-Party Services
KeyKeyKey does not integrate any third-party analytics, advertising, tracking, or crash reporting services.
Third parties contacted:
- The WebDAV server you explicitly configure for sync. It only receives encrypted data.
- Google ML Kit (Android, only when you use the QR scanner) — diagnostic and usage data as described in QR Code Scanning (Android).
Cryptographic Libraries
Encryption is implemented using audited, open-source, pure-TypeScript libraries:
- @noble/ciphers — XChaCha20-Poly1305 encryption
- @noble/hashes — Argon2id key derivation, SHA-256
Data Retention
All data is stored locally on your device. You can delete your vault at any time by uninstalling the app or clearing app data. If you use cloud sync, you can disconnect and delete the sync folder from your cloud provider at any time.
We retain no data because we never receive any.
Children's Privacy
KeyKeyKey does not knowingly collect data from children under 13. Since we collect no personal data and have no user accounts, there is no age-gated data to manage.
Changes to This Policy
If we update this policy, the revised version will be published with an updated "Last Updated" date. Continued use of the app after changes constitutes acceptance.
Your Rights
Because KeyKeyKey stores all data locally on your device with no server-side component:
- Access & Portability: Your data is always on your device. You can export it at any time.
- Deletion: Uninstall the app or clear app data to delete all local vault data.
- Cloud data deletion: Disconnect sync and delete the sync folder from your cloud provider.
For users in the EU/EEA (GDPR), California (CCPA), or other jurisdictions with data protection laws: since we do not collect, process, or store any personal data on our servers, these regulations' data-controller obligations do not apply. You have full control over your data at all times.
Contact
If you have questions about this privacy policy, contact us at:
Email: jdpneto AT gmail.com GitHub: https://github.com/jdpneto/keykeykey
KeyKeyKey is a zero-knowledge application. We cannot access your vault, recover your master password, or read your encrypted data.