Privacy Policy

Effective date: 30 October 2026

In short: KeyTap collects no personal data. There are no accounts, no analytics, no tracking, no ads and no servers of ours.

Who is responsible

Mirox Verwaltungs GmbH, Tempowerkring 6, 21079 Hamburg, Germany. Contact for everything about KeyTap and this policy: support@keytap.me. See also the imprint.

The KeyTap app

What we collect

Nothing. The app has no accounts, no analytics, no tracking, no advertising, no crash reporting and no third-party SDKs. It does not send any data to us or to any other service.

Where the app connects

The app connects to exactly one peer: the computer you paired it with, at the address you entered, on your own network or VPN. What crosses that connection is described on the security page. We never see it.

Optional notifications

Off by default. Only if you switch on Notify Me on This iPhone, the app asks iOS for an Apple push token and gives it to your paired computer – not to us. While a decryption waits, your computer sends our relay at push.keytap.me that token, a random request id, an expiry time and an encrypted summary; the relay passes it to Apple’s push service, which delivers it to your iPhone. The summary (computer, user, command, code) is encrypted with a key only your computer and your iPhone share, and decrypted on the iPhone, so neither we nor Apple can read it. The relay stores nothing: no database, no files, and no log of tokens, ids or contents – only counts of requests. It processes your request in real time and keeps your IP address only in memory for rate limiting, for at most a few minutes (legitimate interest, Art. 6(1)(f) GDPR: keeping the service usable and abuse-free). Apple processes the push delivery under its own privacy policy. Switch the setting off or unpair to stop it; the computer forgets the token. The relay’s source code is public on GitHub.

What stays on your device

The computer’s address, its certificate fingerprint, a pairing token and the handle of the Secure Enclave key are stored in the iOS keychain, this device only – never in iCloud and never in device backups. Decryption requests are held in memory only. Your YubiKey® PIN goes only to the YubiKey and is never stored. You can delete all of it with Settings → Unpair in the app or by deleting the app.

Permissions

NFC: to communicate with your YubiKey when you hold it to the iPhone – to enter the PIN and perform the key agreement. Nothing is read or kept beyond what that operation needs.
Local Network: to connect to your own computer on your local network or VPN. The app contacts no other devices.
Notifications (only if you switch them on): to show that a decryption is waiting. The notification disappears when you answer or when the request expires.

Apple

If you get the app through the App Store or TestFlight, Apple processes data about your download, purchase or test participation under its own privacy policy. We do not receive personal data from Apple about you, other than aggregated analytics that Apple may provide to developers. That processing is governed by Apple’s terms, not by this policy.

This website (keytap.me)

The site sets no cookies, uses no analytics and loads no third-party resources: no external fonts, scripts, images or embeds. Like any web server, ours processes the technical data your browser sends – IP address, time, requested page, status code, browser identification – in standard access logs. We keep these logs only briefly and use them only to keep the site secure and running (legitimate interest, Art. 6(1)(f) GDPR). We do not combine them with other data. The site links to GitHub; if you follow such a link, GitHub’s own privacy policy applies. If you e-mail us, we use your message and address only to answer you, and delete them when the matter is closed, unless the law requires us to keep them.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and to withdraw any consent. Write to support@keytap.me. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, workplace or the place of the alleged infringement. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).

Children

KeyTap is a tool for people who work with encrypted files. It is not directed at children, and we do not knowingly collect data from anyone, children included.

Changes

If KeyTap or this site changes in a way that affects your privacy, we will update this page and its effective date before the change takes effect. The invariant will not change quietly: the app talks only to your own computer.