Privacy Policy

1. Information We Collect

KeySafe is designed to minimize data collection. We categorize the data handled as follows:

• Sensitive Personal Data: This includes your passwords, bank account details, government IDs, secure notes, saved locations, and events & dates. All such data is encrypted locally on your device using AES-256-GCM encryption before being saved.
• Location Data (Optional): If you use the Location feature and tap "Use current location", the app reads your device's current GPS coordinates (latitude, longitude, and altitude) solely to fill in a location entry you are creating. This happens only at your explicit request — we never collect your location in the background or track your movements. Like all other vault data, these coordinates are encrypted on your device and are never transmitted to us or any third party. You may also enter or edit coordinates manually without granting location access.
• Authentication Data: We use Google Sign-In for authentication and to facilitate cloud backups.
• Account Record: When you sign in, we store a minimal account record in our Firebase database, identified by your Google account ID: your Google account email and name, plus basic metadata (platform, app version, selected country, when you set up your vault, and first/last seen dates). It also holds how many items you have in each category (numbers only, for example "12 logins" — used for the free-tier allowance) and any "Notify me" requests you make for categories not yet available in your country (the category, your country, the date, and whether you asked on Android or the web). This helps us run KeySafe and provide support. It never contains the contents of your vault — no titles, values or file names — which remain encrypted and unreadable to us.
• Usage Statistics: We record which features are used via Firebase Analytics — for example "item created: login", "backup", or the length (never the text) of a search. These events are linked to your Google account ID (not your email or name) so we can understand how KeySafe is used across your devices. They never include your vault contents.
• Referral Data: Every account is issued a random 6-character referral code. We store that code, whether it has been used, the grandfathered item allowance recorded for your account (two numbers), and — if you entered someone else's code — which code you used and how many times you have tried entering one. When a code is redeemed we record a link between the two accounts involved, identified by Google account ID, so we know which account earned the reward. This data contains no vault contents. Note that some of it is deliberately kept after account deletion — see section 4.
• Cookies (Web Application): We use strictly necessary cookies for authentication and session management to keep you securely logged in to the web application. Firebase Analytics (Google Analytics) also sets first-party analytics cookies to count feature usage as described above. We do not use cookies for advertising.
• Crash Reports and Device Information (Android): If the app crashes or hits an error, Firebase Crashlytics sends a crash report with device information (such as OS version and device model). Crash reports are linked to your Google account ID (not your email or name) so we can investigate a problem you report. They never include your vault contents.

2. Data Encryption and Storage

We follow a "Zero-Knowledge" architecture — only you can unlock your data:

• Encryption: Everything is encrypted with AES-256-GCM using a key derived from your password (or PIN). That key stays on your device and is never sent to or stored by us.
• Cloud Backup: If you enable backup, your encrypted vault and attachments are stored in KeySafe's private, hidden area within your Google Drive — not visible in your normal Drive view. We cannot read the contents.

3. Third-Party Services

KeySafe uses the following third-party services which may collect information used to identify you:

• Google Play Services: Used for app functionality and authentication.
• Google Drive: Used exclusively for storing and retrieving your encrypted backup.
• Google AdMob: We show advertisements to keep the app free. AdMob may use device identifiers to serve personalized or non-personalized ads based on your consent settings.
• Firebase (Analytics, Crashlytics & Firestore): Used to monitor app stability, understand usage patterns, and store the minimal account record described above (email, name, basic metadata, item counts, "Notify me" requests, and referral data). Analytics events and crash reports are linked to your Google account ID. We never store your vault contents here.

4. Your Rights and Control

You have full control over your data:

• Access and Export: You can view all your stored data within the app.
• Deletion: You can delete individual items, or clear everything with Delete Account in the app (which removes the cloud backup too). You can also remove the backup yourself in Google Drive via Settings → Manage apps → KeySafe → Delete hidden app data, and revoke access at myaccount.google.com.
• What deletion does not remove: When you delete your account we erase your vault, your cloud backup, and these details from your account record: email, name, country, device and app details, your item counts, and your "Notify me" requests. Two things are deliberately kept: the record of which referral code you redeemed and how many times you tried entering one. We keep these solely to stop the same Google account claiming the referral reward over and over by deleting and re-registering. They contain no personal information — a random code, a counter, and timestamps — but they remain associated with your Google account identifier. If a friend had redeemed your code, deleting your account also retires that code so it cannot be used again.
• Permissions: You can revoke camera, storage, or location permissions via your device or browser settings at any time. The location permission is used only when you tap "Use current location"; revoking it simply means you enter coordinates manually.

5. Children's Privacy

KeySafe does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from children under 13.

6. Changes to This Policy

We may update our Privacy Policy from time to time. You are advised to review this page periodically for any changes. Changes are effective immediately after they are posted on this page.

7. Contact Us

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us at:
Email: hello@graypact.com