Keys is developed and published by Abokado Labs. Contact: hello@abokadolabs.com.
Your vault and its encryption key
Keys stores your credentials, notes, tags, organizational labels, revision history, and attachments. Credential content, revision notes, attachment content, and attachment metadata are encrypted before CloudKit synchronization.
New passwordless vaults use a random encryption key. When an existing vault is migrated, Keys retains its encryption key. Normal unlocking no longer requires a separate vault password.
The encryption key is distributed to your other devices through iCloud Keychain. It is not stored in CloudKit records, preferences, diagnostic logs, or exported backup contents. Each enrolled device also retains a separately protected local copy that requires Apple's device-owner authentication to use.
The synchronized key relies on iCloud Keychain's security. It does not inherit the access controls of the device-local Secure Enclave-protected item. Apple's account and Keychain security are therefore part of the protection of your vault.
iCloud storage and synchronization
Keys uses Apple's CloudKit private database for encrypted vault data and iCloud Keychain for key distribution. Both operate with the iCloud account on your device. Your database is not shared with other Keys users or an Abokado Labs account. Apple operates these services under its own terms and privacy practices.
Already enrolled devices can open their local vault while offline. Pending changes are retained locally and synchronized when connectivity returns. New devices need the matching synchronized key before they can open the existing vault; Keys waits or offers recovery rather than silently replacing a vault after a failed lookup.
An iCloud account change locks Keys and stops the previous account's sync work. Local state is partitioned by account and vault identity. Old local data is retained for recovery rather than erased automatically.
System authentication
Keys uses Apple's Local Authentication and Keychain security mechanisms for Face ID, Touch ID, and available device-owner authentication such as the device passcode or Mac login password. Apple performs biometric matching. Keys does not receive or store your biometric templates.
Optional AI and provider requests
Pattern-based extraction from supported text and files runs locally. If you choose AI extraction and provide your own OpenRouter key, selected text or images are sent to OpenRouter and the model provider. Keys presents consent for the selected model; switching models requires renewed consent. These services can see submitted plaintext while processing it. Requests do not pass through an Abokado Labs server. Review OpenRouter's and the selected provider's current privacy and retention terms before submitting sensitive content. You can use local extraction without AI.
Optional credential validation and provider usage features send authenticated requests directly to the relevant credential provider. The provider receives the credential needed to service that request and handles it under its own policies.
Backups and recovery
Portable encrypted backups contain credentials, revision history, and attachments. Their export passphrase is separate from routine app authentication. Exported backups do not contain the raw vault key. Keep backups and their passphrases safe; Abokado Labs cannot recover a missing backup passphrase or supply a missing vault key.
Migration preserves legacy cloud data and recovery material. Keep older recovery information until you have verified the updated apps and a complete backup. Older app versions do not synchronize with the new vault format.
Local integrations and clipboard
The optional macOS CLI and SSH agent communicate with the Mac app through local sockets. They require the app's vault to be unlocked. The CLI does not read the synchronized vault key directly.
Copying a credential places its value on the system clipboard. Keys applies the platform's available privacy hints and clears copied values after its configured timeout. Other software with clipboard access may still be able to read a copied value while it remains there.
Your controls
You can open and edit your records in Keys and export an encrypted backup. The settings distinguish removing data from one device from deleting the synchronized vault. Local removal preserves cloud data and synchronized keys. Deleting the vault everywhere requires explicit confirmation and writes a persistent deletion marker to prevent a returning device from recreating that vault. Offline devices cannot receive this change until they reconnect. Legacy archives and recovery material retained during migration remain separate and must be managed explicitly.
Analytics and required-reason APIs
Keys does not include advertising, analytics, or a developer-operated crash-report collection service. Its privacy manifest declares local use of preferences, file timestamps, available disk space, and system uptime for app functionality. These API declarations are separate from the iCloud and optional provider requests described above. Apple may process service or diagnostic information under its own settings and policies.
Children and policy changes
Keys is not designed specifically for children. If this policy materially changes, an updated version will be published at this URL with a new effective date. Substantial product privacy changes will also be described in release notes.
For questions, contact hello@abokadolabs.com.