Last update 1 October 2026

Privacy Policy — Keyring

Keyring is a local-first, zero-knowledge password manager: no account, no server of ours, and by construction the contents of your vault are unreadable to us. This policy describes what stays on your device, what passes through your own iCloud, and which network connections the app actually opens.

Keyring

1. Data Controller

Aumatex srls — Via Umberto Biancamano 25, 00185 Rome (RM), Italy. VAT IT15617831001.
Requests about personal data: privacy@aumatex.it.

2. Data Collected

Keyring collects no personal data: there is no sign-up, no login, no Aumatex account and no server of ours to send it to.
We do not collect your name, email, phone number, location, device identifiers, usage data or diagnostic data.
The contents of your vault never reach us in any form, neither in plain text nor encrypted.

3. Data Processed Locally on Device

Passwords, passkeys, verification codes, cards, notes and attachments stay in the encrypted vault, on your device.
Preferences (theme, language, auto-lock) and password history also stay local. Site icons are stored encrypted inside the vault, like your items.
Password strength is measured entirely on the device, with dictionaries built into the app: passwords are never sent anywhere to be rated.
Exports and backups are created only when you ask for them, and saved where you choose.

4. Encryption and Master Password

Every item is sealed with AES-256-GCM. The vault key is wrapped by a key derived from your master password and your Secret Key (PBKDF2-HMAC-SHA256, with a floor of 1,000,000 iterations calibrated on your device).
The master password is never stored, on the device or anywhere else, and never leaves the device.
The Secret Key is generated on your device and lives in your own iCloud Keychain and in your Emergency Kit: we never see it.
The stated consequence: if you lose your master password we cannot recover or reset it, and nobody at Aumatex can open your vault.

5. iCloud Sync and Backup

Syncing is optional and uses the private database of your own iCloud account (CloudKit): what reaches iCloud is ciphertext only.
The automatic iCloud Drive backup is optional and produces an encrypted archive that opens with your Secret Key.
That data sits in your iCloud account and is processed by Apple under its own policies. Aumatex has no access to it.

6. Network Connections

The app makes no requests to Aumatex srls servers: none exist.
Sync and backup talk to iCloud (Apple) using your account.
Site icons, when the option is on, are fetched straight from the site an item points to: that site receives an ordinary HTTPS request from your IP address, with no idea who you are or why. The option can be switched off in Settings › Privacy.
The link check, in the Health tab, runs only when you ask for it with “Check Links”: the app visits each site saved in your items once, to see whether it still answers or has moved to a new address. Each site receives an ordinary HTTPS request from your IP address, with no cookies and no idea who you are; the app reads only the first response, not the page. Local and home-network addresses are never contacted. The results stay on the device and are cleared when the vault locks.
Purchases go through StoreKit (Apple): payment details never reach us.

7. Compromised-Password Check (optional)

The check is off until you turn it on.
When it is on, the app computes the SHA-1 hash of a password and sends only the first five characters of that hash to the Have I Been Pwned service (k-anonymity).
The password, its full hash and the item it belongs to never leave the device: the comparison happens locally, against the list the service returns.

8. Device Permissions

Face ID / Touch ID: only to unlock your vault. The biometric data stays in the Secure Enclave and is not accessible to the app.
Camera: only to scan QR codes for verification codes. Images are neither stored nor transmitted.
Every permission can be revoked at any time from system settings.

9. No Tracking, Analytics or Advertising

No telemetry, no analytics tooling, no third-party crash reporting.
No advertising SDKs, no profiling, no advertising identifier (IDFA).
The app ships no third-party dependencies: only our own code and Apple frameworks.

10. Legal Basis and Retention

Aumatex srls processes no personal data through Keyring: it does not receive it, store it, or have access to it.
Your data stays on your device and, if you enable syncing, in your own iCloud account, for as long as you decide.
Uninstalling the app removes the local data; what is in iCloud is deleted from the app or from your iCloud settings.

11. Recipients and Transfers Outside the EU

We disclose no personal data to third parties, because we receive none.
Apple processes iCloud and purchase data under its own policies, within your relationship with Apple.
Have I Been Pwned, if you enable the check, receives five characters of a hash: they identify neither you nor the password.

12. Your Rights

You can exercise access, rectification, erasure, restriction, objection and portability by writing to privacy@aumatex.it.
For the data that stays on your device you exercise those rights directly: you can read, edit, export and delete it in the app, without going through us.
You have the right to lodge a complaint with your data protection authority.