Privacy Policy
Effective Date: October 2026 • Document Version: 1.0 (Zero-Telemetry Architecture)
Zero-Data Retention Architecture
KeyNest operates no authentication servers, telemetry backends, or analytics trackers. All cryptographic operations, key derivations (Argon2id / AES-KDF), and database read/write routines take place exclusively on your local device hardware.
01.Absence of Telemetry & Analytics
When compiling or executing KeyNest binaries:
- Zero logging of IP addresses, hardware identifiers, or operating system characteristics.
- No bundled tracking SDKs, analytics libraries (Google Analytics, Firebase, Mixpanel), or advertising frameworks.
- Network traffic occurs strictly when user-configured cloud synchronization endpoints are called.
02.KDBX Vault Cryptography
Credentials and attachments are persisted using the standardized KeePass KDBX 3.1 & 4.1 file formats.
- Decrypted vault contents are kept strictly in transient memory and purged immediately upon vault lock or application backgrounding.
03.User-Configured Cloud Storage
If you elect to sync your vault with Google Drive, Dropbox, WebDAV (Nextcloud), or OneDrive:
- Databases are encrypted client-side prior to transmission over TLS. Cloud hosts receive only opaque ciphertext blobs.
- OAuth tokens for cloud providers are stored securely in your platform hardware keystore (Android KeyStore / Apple Keychain / Windows Credential Manager).
04.Google API Services User Data Policy (Limited Use)
KeyNest's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Specific Scope of Access: KeyNest requests access to Google Drive (e.g., restricted or drive-file scopes) solely for the purpose of creating, reading, and updating your own user-selected encrypted KeePass (
.kdbx) database backups. - No Access to Unrelated Files: KeyNest never accesses, scans, reads, or modifies any of your personal files, documents, sheets, or photos stored in Google Drive.
- No Third-Party Transfer or Sale: KeyNest does not transfer, sell, or disclose Google user data to any third-party advertisers, data brokers, or AI model providers.
- Direct Device Communication: KeyNest has no proprietary cloud servers; all communication between your device and Google Drive APIs occurs directly and securely via HTTPS/TLS from your local machine or device.
Security Inquiries
Security vulnerability reports can be confidentially submitted via github.com/moshinop/keynest/security.