What does this website handle?
This is a static product website with no sign-in, comments, contact forms, ads, or analytics scripts. It does not use cookies or local storage to track visitors. The homepage demo uses fictional accounts and fixed sample numbers.
When you visit the homepage, we read your browser’s language preferences to choose a supported language. After you switch languages manually, we save that choice in this browser’s local storage and use it on your next visit to the homepage. A URL for a specific language always takes precedence. This preference is used only for language selection, not tracking. Clear this site’s data to reset it. If local storage is blocked, you can still switch languages, but your choice may not be remembered.
Only when you tap a demo ticket does the website try to write the sample code to your clipboard. It does not read your clipboard or ask for real secrets, PINs, or recovery codes.
The website is hosted on a self-managed server. Depending on its configuration, the server may log IP addresses, request times, and paths for operations and security troubleshooting. When you follow external links such as GitHub, the destination website’s privacy policies apply.
How does the app store data?
The current Apple standalone app saves encrypted account data on the device. Biometric unlock keys, PIN-wrapped keys, and failed-attempt counts are stored in the system Keychain. The operating system handles biometrics; the app does not read face or fingerprint templates.
The current flow needs no keyfold server account and has no cloud sync. You keep your own recovery code; there is no server that can recover it for you.
What about future sync?
Planned sync will use storage chosen by the user. The design aims to encrypt data before uploading so storage providers hold ciphertext. This is not available yet. Data-handling and authorization details will be updated when third-party storage is integrated.
Where can I verify this?
The code and vault format specifications are public. This page describes the current implementation and explicitly identified plans; it does not imply a completed security audit.
Do not post real credentials or unredacted data in public Issues.