Privacy Policy

1 Who We Are

MyKeyBox is an independent mobile application developed by an individual developer ("we", "us", "our"). The app is available on Google Play and the Apple App Store.

For any privacy-related questions, please use the contact details provided at the bottom of this document.

2 Data We Do NOT Collect or Store on Our Servers

• Your stored passwords, usernames, emails, or URLs.
• Your master password (stored only as a SHA-256 hash, locally).
• Your personal identity information (name, address, phone number, etc.).
• Your device's biometric data (fingerprint, Face ID). Biometric authentication is handled entirely by the operating system — we never access raw biometric data.
• Your location.
• Usage analytics or crash reports (we do not integrate any analytics SDK).
• Advertising identifiers or tracking data.

3 Data Stored Locally on Your Device

All application data is stored locally using @capacitor/preferences (Android SharedPreferences / iOS NSUserDefaults, both sandboxed). The data includes:

4 How We Protect Your Data

MyKeyBox applies multiple layers of protection to ensure your passwords remain safe even if your device is compromised:

• AES-256 encryption – Industry-standard symmetric encryption protects your entire password vault at rest.
• PBKDF2 key derivation – Your master password is never used directly as an encryption key. Instead, it is run through PBKDF2 with 100 000 iterations and a random 16-byte salt, making brute-force attacks computationally prohibitive.
• SHA-256 hashing – The master password is stored only as a one-way hash for verification; the original password is never persisted.
• Screen capture protection – On Android and iOS, screen capture protection is enabled by default, preventing screenshots and blocking the app preview in the recent-apps switcher.
• Auto-destruct (Pro feature) – All data is automatically wiped after 5 consecutive failed master-password attempts.
• XSS prevention – All dynamic HTML content inside the app is sanitized using Angular's DomSanitizer before rendering.

5 Third-Party Services

MyKeyBox is completely offline regarding your password data. However, the Pro upgrade requires processing a payment, which involves the following third-party service:

5.1 RevenueCat (In-App Purchases)

We use RevenueCat to manage in-app purchases and validate Pro entitlements. RevenueCat may collect or process the following data:

• Anonymous user ID – We pass RevenueCat a pseudonymous identifier in the format prem_<sha256_hash>. This ID is derived from credentials you provide at purchase time using a one-way SHA-256 hash. It is not linked to your real name, email, or any stored password.
• Purchase transaction data – Google Play / App Store transaction receipts are validated through RevenueCat to confirm your entitlement.
• Device and platform metadata – RevenueCat may collect device type, OS version, and app version for purchase validation and fraud prevention.

5.2 Google Play Billing and App Store

Payment processing for the Pro upgrade is handled entirely by Google Play Billing on Android and the Apple App Store on iOS. We do not receive or store your payment card details. The store privacy policies apply: Google Privacy Policy and Apple Privacy Policy .

5.3 No Other Third-Party SDKs

MyKeyBox does not integrate advertising networks, social-media SDKs, crash-reporting tools, or analytics libraries. There are no trackers embedded in the application.

6 Android and iOS Permissions Requested

No permission is used to collect or transmit personal data unrelated to the stated purpose above.

7 Exported Backup Files (Pro)

The Pro version allows you to export your vault as an AES-256 encrypted JSON file or as a PDF document. These files are:

• Generated and stored temporarily in the device's cache directory.
• Shared via the native Android/iOS share sheet – we do not upload them to any server.
• Your responsibility once shared: ensure you share them only through trusted channels.

8 Children's Privacy

MyKeyBox is not directed at children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided personal information through the app, please contact us so we can take appropriate action.

9 Data Retention

Because all password data is stored exclusively on your device:

• App data – Retained until you delete it manually (via "Delete all data" in Settings), enable Auto-Destruct, or uninstall the app.
• RevenueCat data – Retained according to RevenueCat's own data retention policies (see their privacy policy). Your anonymous ID can be regenerated at any time using the same credentials.

10 Your Rights

Depending on your jurisdiction (e.g., GDPR in the EU, CCPA in California), you may have rights regarding your personal data. Because we store no personal data on our servers, most rights are exercisable directly on your device:

• Right to access & portability – Export your vault at any time via the Export function (Pro).
• Right to deletion – Delete all data via Settings → "Delete all data", or uninstall the app.
• Right to rectification – Edit any password entry at any time.
• RevenueCat data requests – For data held by RevenueCat, contact them directly at revenuecat.com/privacy .

To exercise any right not covered above, please contact us using the details in Section 12.

11 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted at the same URL and the "Last updated" date at the top of this document will be revised. For significant changes, we will notify users via a notice within the application or on the Google Play and App Store listings.

Continued use of MyKeyBox after changes are posted constitutes your acceptance of the updated policy.