Privacy Policy

1. Introduction

KCH Labs ("we", "us", "our") operates the SecureKeep mobile application ("the App") and the website at securekeep.app ("the Site"). This Privacy Policy explains what information we do and do not handle, and how.

SecureKeep's vault is built on a zero-knowledge architecture: the passwords, documents, notes, and messages you store in the App are encrypted on your device and are never sent to us. We cannot read them, and we never receive them. The limited information described in this policy relates only to optional support and feedback features, the App's check for bug-fix updates, and standard website analytics, never the contents of your vault.

For the purposes of the EU/UK General Data Protection Regulation (GDPR), the data controller is KCH Labs. You can reach us at support@securekeep.app.

2. Your Vault Data: What We Never Collect

The core of SecureKeep is designed so that we have no access to your personal vault contents. We do not:

• Require an account, login, or registration to use the App
• Collect, transmit, or store the passwords, documents, notes, photos, or video/audio messages you save in your vault
• Have access to your master password or your encryption keys. Your master password is never stored, and your keys are never sent to us
• Use advertising identifiers, tracking pixels, cross-app fingerprinting, or sell/share/trade your data for advertising

3. Vault Data Stored Locally on Your Device

All data you create in SecureKeep is stored on your device, and none of it is sent to us, except what you choose to send us, as described in Section 4:

• Vault data (credentials, documents, notes, video and audio messages): encrypted with AES-256-GCM and stored in a local SQLite database
• Encryption keys: your master password is never stored; a derived key is generated via PBKDF2-SHA256 (600,000 iterations) and held in memory only while the App is unlocked
• Biometric data: if you enable biometric unlock, an encrypted key is stored in your device's secure hardware (iOS Keychain / Android Keystore). We never access or process your biometric data directly; authentication is handled entirely by your device's operating system
• Document and media files: documents, photos, video messages, and audio messages are encrypted and stored in the App's sandboxed file storage on your device

Device backups. SecureKeep never sends your vault to us. On iPhone, if iCloud Backup is on, your phone's own backup includes an encrypted copy of the vault. Apple can't open it; only your master password can. That backup belongs to your Apple account and follows your iCloud settings, not ours, and we don't rely on it to restore your vault: the supported way is a SecureKeep backup file (Settings > Backup & Restore). SecureKeep is set to opt out of Android's cloud backup.

4. Information You Choose to Send Us (Support & Feedback)

SecureKeep includes optional in-app feedback and a website contact form. Apart from the update check described at the end of this section, these are the only features that send information to us, and they are used only when you actively choose to contact us. No vault data is ever included.

When you submit in-app feedback (a bug report, feature request, or testimonial) or use the website contact form, we receive and process:

• The message you write: the subject, body, and category you select
• Your email address: only if you choose to provide it, so we can reply. Leaving it blank submits your feedback anonymously
• A screenshot or attachment: only if you choose to attach one. Screenshots are stored privately and are never publicly accessible
• Basic technical context: the App version, platform (iOS/Android), and device model and OS version. This helps us reproduce bugs. It does not include advertising identifiers or precise location

Legal basis (GDPR). We process this information on the basis of your consent (which you give by submitting the form) and our legitimate interest in providing support and improving the App. You can withdraw consent and request deletion at any time by emailing support@securekeep.app.

Retention. Feedback and support messages are retained only as long as needed to resolve your request and improve the product, and are deleted on request. We do not use this information for advertising or profiling.

App update check. Each time the App opens, it asks our server at securekeep.app whether a newer bug-fix version of the App's code is available, and downloads it if so. This happens automatically and contains no vault data. The request includes:

• Your platform: iOS or Android
• Which version of the App's code you're running: identifiers shared by everyone on the same version, not unique to you, and the identifiers of any update that failed to start on your phone
• An error message, only if the App crashed the last time it ran: added by the updates library so a broken update can be detected. It never contains vault data, because the App never puts vault contents into error messages

The request does not include an account, an advertising identifier, or any identifier for you or your device. Like any request on the internet, it reaches our hosting provider from your network's IP address, along with the standard headers your phone's operating system adds to every web request: the App's build number, the operating system version and your language setting. We don't store the request, the IP address, or the error message. Update files are downloaded from our storage provider in the same way. Every update is signed with a key kept offline by us, and the App rejects any update that isn't signed with it.

Legal basis (GDPR). For the update check, our legitimate interest in fixing bugs and security problems in the App quickly.

5. Testimonials

If you submit a testimonial through the feedback form, you are asking us to consider publishing it. We only publish a testimonial after review, and we publish only the testimonial text and the first name or initials you provide — never your email address or any device information. You can ask us to remove a published testimonial at any time by emailing support@securekeep.app.

6. Website Analytics

Our website (securekeep.app) uses Vercel Web Analytics to understand aggregate traffic — such as which pages are visited and roughly where visitors come from. This analytics is privacy-focused: it does not use cookies, does not track you across other websites, and does not build an advertising profile of you. It applies to the website only. The mobile App itself contains no analytics or tracking SDKs of ours. One exception comes from Google rather than from us: on Android, Google Play's purchase library sends Google its own diagnostic logs (see Section 10).

We also keep a small count of our own, on our own server, to tell whether two things on the site are working: the download prompt that appears on phones, and the videos on the home page. We record that the prompt was shown, tapped or dismissed, that a store badge was tapped, or that a video was played, together with which mobile platform we detected and which page it happened on. If the link that brought you to the site carries campaign tags, like utm_source=instagram, we also count that you arrived through it and record those tags with each count; they describe the link you followed, not you. Store links on the site also carry a campaign name, so Apple and Google can tell us, as totals only, how many downloads each campaign led to: the tags from your link if it had any, or simply "website" if it had none. These counts contain no cookie, no identifier, and no IP address, so they cannot be linked to you or to each other. They are deleted after 180 days. If your browser sends a Do Not Track or Global Privacy Control signal, we record nothing at all, and store links carry no campaign name.

Videos. The videos on our home page show a still image until you press play. Nothing is requested from YouTube before that — no video, no script, no cookie. When you do press play, the player loads from youtube-nocookie.com, Google's reduced-tracking embed domain, and from that point YouTube's own privacy policy applies to what you watch. If you never press play, YouTube is never contacted.

Storage on your device. If you dismiss the download prompt, we store the date you did so in your browser's local storage, so we do not show it again for two weeks. That date stays on your device, is not a cookie, and is never sent to us.

7. Third-Party Services (Sub-processors)

To operate the optional support features, the App's update check and the website, we rely on a small number of service providers who process data on our behalf. They receive only the information described above — never your vault data.

• Supabase: stores feedback and support submissions in a hosted database, and stores the App's signed update files (United States).
• Brevo: delivers support emails, contact-form messages, and feedback auto-replies.
• Vercel: hosts our website, answers the App's update check, and provides the privacy-focused analytics described above.
• YouTube (Google): serves the home-page videos, and only after you press play (see Section 6).
• Apple App Store / Google Play: process your app purchase; on Android, Google also receives its purchase library's diagnostic logs (see Section 10).

Because some of these providers are based in the United States, information you send us may be processed there. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers. If we add or change a service provider in a way that materially affects your privacy, we will update this policy.

8. Device Permissions

SecureKeep may request access to certain device features. These permissions are optional and only requested when you use a specific feature. All data captured through these permissions is encrypted and stored on your device. It is never uploaded or transmitted to us, and we can't access it (the only exception is a screenshot you deliberately attach to a feedback message, per Section 4).

• Camera: used to record video messages and capture document photos for your vault. Recordings and photos are encrypted with AES-256-GCM and stored on your device.
• Microphone: used to record audio messages for your vault. Recordings are encrypted and stored on your device.
• Photo Library: used to let you attach existing photos or documents from your library to your vault. Imported files are encrypted and stored on your device.
• Face ID / Biometrics: used to let you unlock your vault without entering your master password. Biometric authentication is handled entirely by your device's operating system; we never access or process your biometric data.
• Motion Sensors: used to detect when your device is placed face-down, which triggers an automatic vault lock for added security. No motion data is stored or transmitted.

You can revoke any of these permissions at any time through your device's Settings. Revoking a permission will disable the corresponding feature but will not affect your existing vault data.

9. Backup Feature

SecureKeep includes an encrypted backup feature that allows you to export your vault data:

• Backups are encrypted with a separate passphrase you choose, using AES-256-GCM
• Backup files are created locally and shared using your device's share sheet
• We never receive, transmit, or store your backup files
• You are solely responsible for where you store your backup files

10. App Store Data

When you purchase SecureKeep through the Apple App Store or Google Play Store, the respective platform processes your payment. We do not receive or have access to your payment details. Please refer to Apple's or Google's privacy policy for information about how they handle purchase data.

Google Play's purchase library on Android. To show, sell and restore SecureKeep Pro, the Android App uses Google Play's billing library. It starts when the App opens and sends Google diagnostic logs about how the library itself is working. The library has no access to your vault, so these logs can't contain your vault data or anything you type into the App, and they go to Google, not to us. We're removing this logging in an upcoming Android update. Until then, Google's privacy policy covers it.

11. Your Rights Under GDPR (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability. Because your vault data is stored on your device and never sent to us, you already have full, direct control over it:

• Access: all vault data is on your device and fully accessible to you; for any feedback you have sent us, email us for a copy
• Delete: delete the App or use the "Delete Vault" option in Settings for vault data (a copy in your phone's own backup stays until that backup is replaced or deleted, which you control in your iCloud settings); email us to delete any feedback or support messages you have sent
• Data portability: use the encrypted backup feature to export your vault data
• Rectification: edit any information directly within the App

You also have the right to lodge a complaint with your local data protection supervisory authority.

12. Your Rights Under CCPA (California Residents)

SecureKeep does not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioral advertising. Vault data remains on your device under your control. For any support or feedback data you have sent us, you may request access or deletion by emailing support@securekeep.app.

13. Children's Privacy

SecureKeep is not intended for use by children under the age of 13, and we do not knowingly collect any information from children. If you believe a child has sent us personal information through the feedback or contact form, please contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected in the "Last updated" date at the top of this page and, for material changes, communicated through an app update. Continued use of the App or Site after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise any of your rights, contact us at:

support@securekeep.app