KeythenticThis Privacy Policy explains what data the Keythentic Android app ("Keythentic," "the app," "we," "us") touches, how it's protected, and what we can and cannot see. We've written it in plain language on purpose — if anything here is unclear, contact us and we'll clarify or fix it.
The short version
Keythentic is designed so that your vault — your two-factor codes, saved passwords, cards, notes, and passkeys — is encrypted on your device before it is ever written to storage or sent anywhere. It is locked with a master password that only you know. We do not have access to your master password or to the contents of your vault, whether it stays only on your device or you choose to back it up.
What data the app handles, and where it goes
Your vault (TOTP/HOTP secrets, passwords, cards, notes, passkeys)
Everything you store in Keythentic — authenticator secrets, saved logins, credit card details, secure notes, and passkeys — is encrypted on your device using a key derived from your master password before it is written to local storage. This encryption happens entirely on your phone. We never receive this data in a readable form, because we don't operate a server that your vault is sent to in the first place.
Your master password
Your master password is never transmitted anywhere and is never stored, by the app or by us, in a form that could be reversed back into the password. If you forget it, we have no way to recover it or your vault for you — see the Security page for why that's a deliberate design choice, not an oversight.
Optional Google Drive backup
If you turn on backup, Keythentic uploads your vault file — already encrypted, exactly as described above —
to a private, app-specific storage area of your own Google Drive account (Google's appDataFolder).
This area is not visible in your regular Google Drive file browser and is not accessible to other apps. The
file goes to your Google Drive, not to a server we operate. We never see the contents of this backup, and we
cannot decrypt it — only your master password can. You can also export an encrypted backup file locally,
entirely independent of Google, as a backup option that doesn't rely on any third party.
Biometric unlock
If you enable fingerprint or face unlock, that authentication is handled entirely by your device's own operating system and secure hardware via the Android Keystore. Your biometric data is processed and stored on your device by Android itself — it is never transmitted to Keythentic, and we never see it or store it anywhere.
Acting as an Autofill provider and passkey (Credential Manager) provider
If you choose to set Keythentic as your Android Autofill service, or as a Credential Manager passkey provider, Android grants the app the ability to read relevant on-screen fields of whatever app or website you're filling into (so it can offer a saved credential or a new suggested password), and to handle passkey creation/sign-in requests on your behalf. This access is entirely local to your device, is used only to provide the autofill/passkey functionality you asked for, is governed by Android's own permission system, and can be turned off at any time in your device's Settings. It does not involve sending this data to us.
Service logos (optional, off by default)
Keythentic can show each service's own logo beside your accounts. Apart from the optional product-announcement check, it is the only feature in the app that contacts a server we operate, and it is switched off until you turn it on, in Settings → Service logos.
With it on, the app asks keythentic.com for the logo of a service as you add it, so our server learns which services you have accounts with. It never learns your usernames, your passwords, your codes, or anything else from your vault. The request carries no cookie, no account or installation identifier and no analytics of any kind. The app can only ask about services on a list of brand names, which it matches against what you typed on your device — so a name you invent for an account is never sent, and an account we have no logo for produces no request at all. A logo we have is downloaded once and kept on your device, so that service is never asked about again; a service we have no logo for is re-checked about once a month, in case we have added one.
That list of brand names is itself downloaded, and this is a second request rather than part of the first. The app ships with a copy of the list and, while this feature is on, fetches a fresh one from keythentic.com at most once every seven days; the two are combined, so the app always knows at least the brands it shipped with, and a failed download never leaves it knowing fewer. That request carries nothing about you either — no account or installation identifier, no cookie, not even which version of the app you are running — and the file it fetches is public, byte for byte what your phone receives: keythentic.com/icons/v1/catalogue.json. Nothing signs it beyond the HTTPS connection it arrives over.
These requests reach us through our CDN, Cloudflare, which sits in front of keythentic.com and handles them as it does any other request to this site. On our own server, request logging is switched off for both of these endpoints, so we keep no log of who asked for which logo. Turning the feature off in Settings stops all of it — the logo requests and the list — and the same screen offers to delete the logos and the list already downloaded.
Contact form messages (this website)
If you use the contact form on this website, we store the name, email address, and message you submit in our database so we can respond to you, and we may attempt to send ourselves an email notification of your message. We use this information only to respond to your inquiry.
Standard web server logs
Like most websites, our web server automatically logs basic technical information for security and operational purposes (such as IP address, browser user-agent, and request timestamps) when you visit keythentic.com. We don't use this for tracking or advertising, and this site does not use third-party analytics or advertising trackers.
The Keythentic browser extension
The optional extension for Chrome (and Edge and Brave) signs you in on a computer by approving on your phone. It handles your usernames, passwords and 2FA codes only to fill them into the sign-in page you asked it to, and, when you choose, to send a login you typed by hand to your phone. It does not store any of them: no passwords, keys, browsing history or settings are written to the computer. While a request is open it keeps the tab, page address and, for a save, the login you typed in the browser's session memory, for at most a few minutes; that memory is cleared when the browser closes.
Between your phone and the computer, everything is end-to-end encrypted with fresh keys for each request. The two connect through a relay on keythentic.com that forwards encrypted messages it cannot read. The relay keeps no logs of the messages or of who connects, and stores nothing once a request ends. The extension reads the fields of a page only to find sign-in fields and to fill them, and sends nothing about the pages you visit to us or anyone else. It contains no analytics or advertising code.
What we don't do
- We do not sell your data.
- We do not share your vault contents or personal information with third parties for marketing or advertising purposes.
- We do not have a mechanism to decrypt your vault, with or without your cooperation — the encryption is designed specifically so that we can't.
- We do not run advertising or third-party analytics trackers on this website.
Deleting your data
Because Keythentic has no server-side account system, there's no "delete my account" request to send us — your data lives on your device and, optionally, in your own Google Drive. See our dedicated Data & Account Deletion page for exact steps.
Children's privacy
Keythentic is not directed at children, and we do not knowingly collect personal information from children.
Changes to this policy
If we make material changes to this policy, we'll update the "Last updated" date at the top of this page. We encourage you to review it periodically.
Contact
Questions about this policy or how your data is handled? Reach out through our contact form — we read every message.