KeyWarden Privacy Policy

Last updated: October 28, 2026

Overview

KeyWarden is an offline password manager. Your vault is encrypted and stored on your device. There is no account, no cloud sync and no analytics, and we do not operate any servers or cloud services for this app. We never see your master password or anything in your vault, and we could not recover them for you.

Data Collection

We do not collect any personal data. KeyWarden does not send your vault, your master password or any other data to us or to anyone else. The app shows no ads and contains no advertising or analytics SDK.

Data Stored on Device

KeyWarden stores the following on your device:

• Your vault — logins (title, website, username, password, notes, category), payment cards (cardholder name, card number, expiry date and security code) and secure notes. The whole vault is kept encrypted (see Data Security).
• Master password check data — a random salt, the key-derivation iteration count, and a small encrypted test value used to check the master password you type. The master password itself is never stored.
• Biometric unlock key — only if you turn on biometric unlock (see Permissions).
• Settings — auto-lock time, whether biometric unlock is on, when the app was last active, and failed-unlock counts used to slow down repeated wrong guesses.
• Purchase status — whether KeyWarden Pro is unlocked.

Backup, Import and Export

• Export backup — writes your vault to a backup file (JSON) that is encrypted the same way as the vault, under your master password, and opens your device's share menu so you can save or send it to a place you choose. The file can only be read with the master password that was in use when you exported it.
• Import backup — reads a KeyWarden backup file you pick with your device's file picker.
• Import CSV — reads a CSV file exported from another password manager or browser, which you pick with your device's file picker. KeyWarden encrypts the imported entries into your vault and deletes its own temporary copy of the file. The original CSV file is not encrypted; the app reminds you to delete it.

Data leaves your device only when you export a backup and choose where to send it. What happens to the file then is governed by the app or service you chose.

Network Communication

KeyWarden makes no network requests of its own and works fully offline. The only internet traffic is Google Play Billing on Android or the Apple App Store on iPhone and iPad, when you buy or restore KeyWarden Pro. If you tap a saved website address, the app hands it to your browser, which opens the site.

Permissions

Biometric unlock (fingerprint, Face ID or Touch ID). Optional, off until you turn it on. When it is on, the key that unlocks your vault is stored in your device's secure storage (on Android, storage protected by the Android Keystore; on iPhone and iPad, the Keychain, set to this device only) behind a biometric check, so your device releases it only after your fingerprint or face is recognised. KeyWarden never sees or stores your fingerprint or face data; the check is done entirely by your device's operating system. Turning biometric unlock off deletes the stored key.

KeyWarden does not use your camera, microphone, location, contacts or photos.

Third-Party Services

KeyWarden does not integrate with any advertising network, analytics, crash-reporting or tracking service. Apart from Google Play Billing (Apple's App Store on iPhone and iPad), no third-party service, SDK or API is integrated.

In-app purchases. Any purchase inside the app is handled by Google Play Billing on Android and by the Apple App Store on iPhone and iPad. Google or Apple processes the payment and keeps the record (Apple under Apple's Privacy Policy); the app only learns whether the purchase is active. We never see your payment details. Restoring a purchase checks your Google Play or App Store account.

Data Security

• Encryption. Your vault is encrypted with AES-256-GCM. The key is derived from your master password with PBKDF2 (HMAC-SHA256, 100,000 iterations) and a random 32-byte salt, and is held in memory while the vault is unlocked. The salt, iteration count and master-password check value are kept in your device's secure storage (on Android, storage protected by the Android Keystore; on iPhone and iPad, the Keychain, this device only).
• Clipboard. A password or other secret you copy is cleared from the clipboard after 30 seconds. On Android it is marked as sensitive, so it is not shown in clipboard previews. On iPhone and iPad it is kept off Universal Clipboard, so it does not reach your other Apple devices.
• Screens. On Android, screens that show secrets block screenshots and are hidden in the Recent apps view. On iPhone and iPad, the app blurs its window in the App Switcher.
• Auto-lock. The vault locks again after the auto-lock time you choose.
• Device backups. On Android, the vault and its key material are left out of Google's cloud backup and of phone-to-phone transfer. On iPhone and iPad, the vault is left out of iCloud and computer backups, and the Keychain items are this-device-only. To move your vault to a new device, use Export backup.

Uninstalling the app deletes your vault. If you forget your master password, the vault cannot be decrypted by us or anyone else.

Children's Privacy

KeyWarden is not directed at children under 13. We do not knowingly collect information from children.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date.

Contact

If you have questions about this privacy policy, contact us at:

Griswold Labs
7965 State Road 50, Suite 1000-166
Groveland, FL 34736
Email: [email protected]