Privacy Policy
Last updated: 22 October 2026
The short version. Your authenticator secrets are encrypted on your device before they reach us, with a key we never have. We can’t read your codes, account names or folders. We keep the minimum needed to run your account, never sell data, and only collect usage analytics if you say yes.
1. Who we are
Keepr (the mobile app, the browser extension and keepr.stryvo.tech) is operated by Stryvo, a sole proprietorship based in India (“we”, “us”). We are the data controller (“data fiduciary” under India’s Digital Personal Data Protection Act, 2023) for the personal data described here. Contact us at privacy@stryvo.tech.
2. How encryption works
When you create an account, your phone generates a random vault key. Your password is processed on your device (scrypt) into two separate keys: one is sent to us so we can verify sign-ins (we hash it again before storing it), and the other encrypts your vault key and never leaves your device. Each authenticator account and folder is encrypted individually on your device (XChaCha20-Poly1305) before upload.
We therefore cannot decrypt your secrets, see which services you use, or read your folder names — and we cannot recover them for you. Your recovery key (shown once when you sign up) is the only way to reset your password without losing synced codes.
If you use Keepr without an account, nothing about your codes leaves your device.
3. What we collect
| Data | Why | Details |
|---|---|---|
| Email address | Your account, sign-in codes, security alerts | Verified with a one-time code. Used to send verification, password-reset and security emails (e.g. “new device signed in”). We don’t send marketing email unless you opt in. |
| Authentication data | To verify it’s you | A hash of a key derived from your password, the key-derivation salt and settings, and two encrypted copies of your vault key (one per password, one per recovery key) that we cannot open. |
| Encrypted vault | Sync and backup (account users only) | Ciphertext of your accounts and folders, plus item ids, item type (account or folder), revision numbers and timestamps. We can see how many items you have, not what they are. |
| Device information | Managing signed-in devices | Device name and platform (e.g. “Pixel 8 · android”, “Chrome on Windows”), a public encryption key, and when the device was added and last seen. |
| Security logs | Protecting your account, preventing abuse | Sign-ins, failed sign-ins, password changes, device links and removals, with IP address and browser/app user agent. You can see your own log in the app. |
| Purchase information | Providing Keepr Pro | Your plan, subscription status, trial and renewal dates, and an identifier from the payment provider. We never receive your card or bank details. |
| Usage analytics (optional) | Improving the app | Only if you tap “Allow”. Which screens are opened and which features are used (e.g. “account added via QR”, “sync completed”), plus device model, OS and app version. Never codes, secrets, account or folder names, or email addresses. You can turn this off any time in Settings → Privacy. |
| Support messages | Helping you | Whatever you choose to send us by email. |
4. What we never collect
- Your password, your vault key or your recovery key.
- Your two-factor secrets, codes, the names of the services you use, or your folder names.
- Your app-lock PIN or biometrics (these stay on your device; biometrics are handled by your phone’s operating system).
- Photos from your camera. The camera is used only to read QR codes; images are not stored or uploaded.
- Your contacts, precise location, or browsing history.
Our website does not use cookies or analytics.
5. How we use data
- To provide the service (performing our contract with you): accounts, sync, linking browsers, purchases.
- To keep Keepr secure (our legitimate interest in preventing fraud and abuse): rate limiting, detecting stolen sessions, security alerts.
- To improve Keepr (your consent): optional analytics.
- To meet legal obligations: tax and accounting records for purchases, responding to lawful requests.
We do not sell or rent personal data, show ads, or use your data to train AI models.
6. Who processes it
We use a small number of service providers that process data on our behalf under contract:
| Provider | Purpose | Data |
|---|---|---|
| Cloud hosting provider | Running our servers and databases | All server-side data above (vault data is encrypted) |
| Cloudflare | Hosting this website, network security | IP address and request details when you visit |
| Resend | Sending verification and security emails | Email address, message content |
| Lemon Squeezy | Merchant of record for web purchases (payments, tax, invoices) | Email, payment and billing details you give them |
| Google Play & RevenueCat | In-app purchases on Android | Purchase details and your Keepr account id |
| PostHog (only if you opt in) | Product analytics | Usage events described above |
Lemon Squeezy and Google act as independent controllers for the payment data you give them; their privacy policies apply. We may disclose data if required by law, but for your vault we can only ever hand over ciphertext. These providers may process data outside your country; where required we rely on appropriate safeguards such as standard contractual clauses.
7. How long we keep it
- Account, vault and devices: until you delete your account. Deletion removes them from our live systems immediately; encrypted backups age out within 30 days.
- Deleted items (so other devices learn about the deletion): up to 90 days.
- Security logs: up to 400 days, then deleted.
- Payment event records: up to 90 days in our systems; payment providers keep invoices as tax law requires.
- Analytics: as configured in our analytics provider, and deleted on request.
8. Your rights & choices
Depending on where you live (including under the GDPR, UK GDPR and India’s DPDP Act), you can ask us to access, correct, delete or export your personal data, object to or restrict certain processing, and withdraw consent at any time. You can do most of this yourself:
- Export: Settings → Backup & restore creates an encrypted backup of your codes.
- Delete: Settings → Delete account & data, or follow these steps.
- Analytics: Settings → Privacy → Share anonymous usage data.
- Devices: Settings → Devices & extensions shows and removes signed-in devices.
For anything else, email privacy@stryvo.tech. We reply within 30 days. Grievances under Indian law can be sent to our Grievance Officer at the same address. You also have the right to complain to your local data-protection authority (in India, the Data Protection Board of India).
9. Browser extension
The Keepr extension stores your encrypted vault and its device keys in the browser’s extension storage, encrypted under a PIN you choose. While unlocked, the decrypted vault key is kept only in memory and is cleared when you lock it, after inactivity, or when the browser closes. When you open the extension, it reads the address of the current tab only to suggest matching codes, and it writes a code into the page only when you click “Fill”. It does not read or transmit your browsing history or page contents.
10. Security
Beyond end-to-end encryption, we use TLS for all connections, store secrets in each platform’s secure keystore, rotate and revoke session tokens, rate-limit sign-ins and detect stolen sessions. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
11. Children
Keepr is not directed to children under 13 and we do not knowingly collect their data. Where local law sets a higher age for consent (for example 18 in India), users below that age may only use an account with a parent’s or guardian’s consent. If you believe a child has given us personal data, contact us and we’ll delete it.
12. Changes & contact
If we make material changes we will notify you in the app or by email before they take effect. The date at the top shows the latest version.
Stryvo · India · privacy@stryvo.tech · support@stryvo.tech