Privacy Policy

1. Who we are

nkey is provided by Flavio Aiello (digitalcommons.ch), Switzerland, who is responsible for personal information handled by us. Contact info@nkey.me for support or privacy questions.

This policy covers nkey.me, its interactive preview, and the nkey app, browser extension and native companion where available. The first public Android test is being prepared; features and availability may differ between builds.

2. Information on your devices

Your vault can contain passwords, usernames, website addresses, secure notes, cards, authenticator secrets and passkeys. Vault contents are stored encrypted on your devices and opened locally when you unlock nkey. We do not operate a server that receives your master password or stores your vault.

nkey also creates cryptographic device identities and stores settings, device labels, linked-device information and sharing permissions. Some local preferences and connection metadata are stored separately from the encrypted vault.

On supported devices, the operating system can approve access using biometrics or a device credential. nkey receives the result of that check, not your fingerprint or facial biometric template.

3. Device sync and sharing

Linked devices exchange encrypted vault data over the Korium peer-to-peer network. When you grant access to shared collections, authorized recipients can access the data covered by that grant. We do not hold a provider-hosted copy for synchronization or recovery.

Network privacy has limits: peers and discovery services your device connects to can see connection information such as its IP address and public device identifier. Local network discovery can announce device identifiers and connection information to other devices on the same network. Encryption protects vault contents; it does not make network connections anonymous.

Only link devices and share information with people you trust. Removing access cannot erase information someone has already copied or exported.

4. Autofill, passkeys and device access

• Autofill: nkey uses the requesting website or app identity and relevant form information to find matching credentials. After your approval, selected credentials are passed to that website or app. Saving a new or updated login also requires confirmation.
• Browser extension: the extension communicates with the native companion on your computer. Its active-tab and scripting permissions allow it to inspect and fill the page you invoke it on; it does not require access to your entire browsing history.
• Passkeys: nkey uses private keys locally to produce the response requested by a compatible website or app. The private key itself is not sent to that service.
• Clipboard: copying a value places it on your system clipboard. Other software may be able to read or retain it, even if nkey later clears the clipboard.
• Camera and files: camera access is used for QR scanning. System file and sharing interfaces let you choose where to import, export or store backup files.

5. Android QR scanner diagnostics

The Android QR scanner uses Google ML Kit. QR recognition runs on your device. The SDK collects device and app information, installation identifiers, performance measurements, scanner events, configuration details, input/output sizes and error codes for diagnostics and usage analytics. Google describes this processing in its ML Kit data disclosure and Privacy Policy.

You can paste a pairing code instead of using the camera scanner. nkey does not include advertising SDKs or sell your personal information.

6. Backups, retention and deletion

You can export an encrypted backup protected by its own passphrase. You choose its destination. If you save or share it through a cloud storage, email or other service, that provider handles the file under its own policy. Anyone with both the backup and its passphrase may be able to recover its contents and the authority included in that backup.

Items moved to trash remain recoverable until the trash is emptied. Deletions must synchronize before other linked devices reflect them. Old exports, disconnected devices and copies already held by recipients are not erased by deleting an item on one device.

You control local vault retention. To stop using nkey, remove its local data and separately delete exported backups and any companion copies you no longer need. Uninstalling one component does not remove data from other devices or exported files.

There is no provider password reset. If you lose all ways to unlock your vault and have no usable backup and passphrase, we cannot recover its contents.

7. Website and interactive preview

nkey.me is hosted through Cloudflare Pages. Cloudflare processes technical request and network data, including IP addresses and information about traffic to the site, to deliver and protect it. See Cloudflare’s Privacy Policy for its handling of this information.

We do not embed advertising trackers or behavioural analytics in this website. The interactive preview uses sample data and keeps changes in the current browser page; it does not submit a vault to us or connect to your real nkey vault. Reloading resets the demo. Please use fictional information in it.

8. Information you send us

If you email us, we receive your email address, message and any attachments you choose to send. Our mail delivery providers also handle that correspondence. We use it to answer your request, provide support and meet legal obligations, and retain it only as long as needed for those purposes.

Please do not send master passwords, backup passphrases or real vault contents. Use redacted examples when reporting a problem. We may disclose information we actually hold to service providers needed to handle your request, when legally required, or where necessary to protect legal rights. We cannot provide vault contents we do not possess.

Where applicable law requires a legal basis, we rely on handling your requested service or support, our legitimate interests in operating and protecting the website, legal obligations, or consent where required.

9. International processing

Your linked devices and chosen recipients may be in other countries. Hosting and scanner providers may also process technical information outside Switzerland, including in the United States. Cloudflare and Google describe their international processing and safeguards, including relevant Data Privacy Framework certifications and standard contractual clauses, in Cloudflare’s policy and Google’s data transfer framework notice. Their retention practices apply to the information they handle.

10. Your choices and rights

You can manage vault items, linked devices, sharing, backups and system permissions on your own devices. For information we hold, applicable law may give you rights to access, correct, delete or receive a copy of your data, restrict or object to processing, or withdraw consent without affecting earlier lawful processing.

Contact info@nkey.me to exercise those rights. We may need to verify your identity, but will not ask for your vault secrets. You can also contact your local data protection authority, including the Swiss Federal Data Protection and Information Commissioner.

11. Changes and contact

We will publish changes on this page and update the date above. Where required, material changes will be brought to your attention and any necessary consent requested. Questions about this policy can be sent to info@nkey.me.