Privacy Policy

KeyAuthy is a private, end-to-end encrypted vault for two-factor codes, passwords, and passkeys. This policy covers the KeyAuthy web app, the installable PWA, the desktop app, and the KeyAuthy browser extension.

• Your account email address, used only to sign you in and to authorize access to your own vault.
• Your vault records (2FA secrets, passwords, passkeys) in encrypted form.
• Local preferences such as theme, pinned items, and unlock state on your device.

KeyAuthy contents are encrypted in your browser with AES-256-GCM using a key derived from your master passcode. Your passcode and derived keys never leave your device and are never transmitted to or recoverable by us. If you lose your passcode, we cannot restore your data.

• We do not sell or transfer your data to third parties.
• We do not use or transfer your data for purposes unrelated to the app's core function.
• We do not use your data for creditworthiness or lending purposes.
• We do not run advertising, tracking pixels, or third-party analytics profiling.
• We do not read your browsing history or the contents of pages you visit.

The extension accesses the active tab only after you click "Fill" or "Copy" for one of your own saved items, and only to place that value into the page's form fields. Its host permissions are limited to KeyAuthy's own domains and API endpoint. All extension code is bundled in the package; no remote code is loaded or executed.

Your data is kept until you delete it. You can delete individual tokens and passwords in the app at any time, or request full account deletion by emailing us; we remove all associated records.

Questions about this policy or your data: support@keyauthy.com. See also our support page.