Privacy policy

Published 29 August 2026. Updated 10 October 2026. Effective 10 October 2026.

The short version

KeyNesta processes your two-factor authentication secrets on your device only. If you turn on sync, our servers store encrypted data we cannot read, plus the few account details listed below. The apps contain no ads, no advertising identifier, no tracking and no crash reporter, and we never send marketing email. On Android, QR scanning uses Google's ML Kit, which reports diagnostic data to Google, as described below. This website and the web app set no cookies and run no third-party analytics; our servers keep ordinary access logs for up to 15 days and page-visit statistics with IP addresses for 14 days. We never sell your data.

Who we are

KeyNesta is operated by BitsSolved Software, a sole proprietorship registered in India (MSME Udyam registration UDYAM-TN-09-0109230), at 13-124A, Manalivilagathu Veedu, Kalkulam, Thickanamcode, Nagercoil, Kanniyakumari District, Tamil Nadu 629804, India. Where data protection law applies, BitsSolved Software is the data controller for the personal data described here. Privacy questions go to privacy@keynesta.com.

What we can never see

• Your 2FA secrets and the codes they generate
• The names of the services and accounts in your vault
• Your tags, spaces, groups, and vault contents in general
• Your vault passphrase and encryption keys

These are encrypted on your device before any optional upload. This is architectural, not a promise of good behavior. See the security architecture.

Without an account

The app is fully functional offline and needs no account. Without a sync account, the iPhone and iPad app sends nothing to us. The Android app sends nothing to us either, but scanning a QR code with the camera starts Google's ML Kit, described under QR scanning on Android.

What we store if you create a sync account

• Your email address: it identifies your account and lets you sign in. We use it only to run your account: a password-reset link when you ask for one, and notices about changes to these terms or to the service. We do not send marketing email and do not add your address to any mailing list.
• A hash of your account password (bcrypt), never the password itself, and none at all if you only sign in with Google or Apple. This password authenticates sync; it cannot decrypt your vault.
• Encrypted vault objects: opaque ciphertext with version numbers and timestamps needed for syncing.
• Device records: the name and platform you give each device, and when it last synced, so you can review and revoke access.
• Your key slot: your master key, wrapped under a key derived from your vault passphrase with scrypt, plus its salt and parameters. It cannot be opened without your passphrase.
• Your plan: whether the account is on the free plan or Pro, where Pro came from and when it ends. If you request Pro Early Access, we keep the request, the optional note you write with it, and our decision.
• Password-reset tokens: only a hash of each token, which expires after one hour and works once.

What the KeyNesta server stores lists every record field by field.

Signing in with Google or Apple

• Sign in with Google (web app, iPhone, iPad and Android): Google tells us your email address and your Google account ID, which we use to identify your account. We request nothing else and write nothing back to your Google account. In the web app, the Google sign-in button is loaded from Google's servers.
• Sign in with Apple (iPhone, iPad and web app): Apple tells us a stable Apple user ID and an email address, which can be your real address or a private relay address Apple creates if you choose Hide My Email. If you share your name, it stays on your device and is synced only inside your encrypted vault; our server never receives it in readable form. When you delete your account in the iPhone or iPad app, we also ask Apple to revoke KeyNesta's access to your Apple ID. You can stop using Sign in with Apple for KeyNesta at any time in your Apple Account settings. In the web app, the Apple sign-in button is loaded from Apple's servers.

Google and Apple handle what happens on their side under their own privacy policies.

QR scanning on Android

The Android app reads QR codes with Google's ML Kit barcode scanner. The camera image is decoded on your phone and the QR code's contents go straight into your encrypted vault; they are not sent to us or, as far as Google's disclosure describes, to Google. ML Kit does send Google diagnostic and usage data: device information (such as manufacturer, model and Android version), the app's package name and version, performance metrics, error codes, event types, and a per-installation identifier that Google says is not intended to identify you or your device. Google states that it encrypts this data in transit and does not transfer it to third parties (Google's ML Kit data disclosure). If you would rather avoid it, add accounts by pasting the setup link or typing the secret. The iPhone and iPad app scans with Apple's own on-device camera framework and contains no ML Kit.

Server logs

Like every web server, ours keep access logs for keynesta.com, the web app, the sync API and our staff portal: the requesting IP address, time, requested address, HTTP status, response size, referring page and browser or app user-agent string. They contain no vault data, no secrets and no generated codes.

• Why: to keep the service secure and working, which means spotting abuse, attacks and outages.
• How long: the logs rotate every day and each day's file is deleted after 14 rotations, so no log line is older than 15 days.

Visit statistics

We count visits to this website, the web app's pages and our staff portal from those same access logs, on our own server, with no tracking script, no cookie and no outside analytics service. Requests that the KeyNesta apps make to the sync API are not part of these statistics.

• What is kept: for each page view or failed request, the IP address, time, page, status, referrer, user-agent string, and an approximate location (country, region, city and network operator) that our server looks up from the IP address in a database it holds locally. Visitors are counted per day with a salted hash of the IP address and user agent that changes every day, so the statistics cannot follow anyone from one day to the next.
• How long: these rows are deleted automatically after 14 days. After that we keep only daily totals per site (requests, page views, errors and data transferred), which hold no IP address, location, user agent or anything else about a person, and we keep those indefinitely.
• How we use it: to see how many people read a page and where they came from, and to investigate abuse. Staff can look up the recent requests from one IP address for that purpose; each lookup is recorded in our audit log by a keyed hash of the address, not the address itself. We do not link these records to sync accounts.

Why we are allowed to hold it

We process account data to perform the agreement you enter into when you create a sync account, which is what data protection law calls contractual necessity. Server logs and visit statistics are kept on the ground of legitimate interest in running a secure, reliable service and understanding how it is used, and only for the periods above. Because nothing here uses cookies or tracks you across sites, there is nothing that requires a consent banner.

How long we keep it

• Sync account data: for as long as your account exists. Deleting the account removes it immediately. We keep no separate backup copy of the sync database, so it cannot come back.
• Server access logs: up to 15 days.
• Visit statistics with IP addresses: 14 days. Daily totals without personal data: indefinitely.
• Password-reset tokens: one hour, as a hash.
• Audit records of decisions on Pro Early Access requests and of staff actions on an account: kept for our records after the account is deleted. They hold the internal account number, not your email address or IP address.

Who else touches the data

We keep the list of third parties as short as we can. Today it is:

• Hetzner Online GmbH (Germany), on servers in Helsinki, Finland, which hosts the servers running the website, the web app and the sync API. The database runs on that same machine and is not exposed to the internet.
• Google, if you choose Sign in with Google, to verify who you are at sign-in; and, in the Android app, through ML Kit as described above.
• Apple, if you choose Sign in with Apple, to verify who you are at sign-in, and to revoke that sign-in when you delete your account.

Apple's App Store and Google Play handle app downloads under their own policies. We use no analytics provider, advertising network, data broker, profiling vendor or content delivery network. We do not send email today; if we turn on password-reset email, we will name the email delivery provider here before it starts.

Before 10 October 2026, the email addresses of new sync accounts were also copied into SalesBook, a customer-contact tool we run ourselves. We stopped that on 10 October 2026. When you delete your account, your address there is marked unsubscribed. To have it removed from SalesBook entirely, write to privacy@keynesta.com.

Where the data is

Our servers are in the European Union, in Finland. BitsSolved Software operates them from India, so the people who run the service may access the data from there.

This website and the web app

The pages on keynesta.com set no cookies and make no third-party requests. There is no Google Analytics, no tag manager, no pixel, no embedded video or map, and no content delivery network. Every font, script and image is served from our own servers. We removed Google Analytics in September 2026.

The web app at app.keynesta.com also sets no cookies. It keeps your encrypted vault and your settings in your browser's own storage. It contacts Google or Apple only to show their sign-in buttons when you open the sync sign-in screen.

What we don't do

• No advertising, advertising SDKs or advertising identifiers, anywhere.
• No selling or renting of any data, and no sharing of it for anyone else's purposes.
• No tracking across other companies' apps or websites.
• No marketing email.
• No crash reporting SDK and no analytics SDK. The only third-party code that reports anything is ML Kit in the Android app, described above.
• No cookies on this website or in the web app.
• No logs of secrets or generated codes.

Your rights and controls

Zero-knowledge design means most of these you exercise yourself, without asking us:

• Access and portability: export your data at any time as encrypted backup files (in the web app) or standard export formats, self-service.
• Deletion: delete individual devices, or your entire account in Settings, then Sync, then Delete Sync Account. That erases your email, password hash, sign-in provider ID, encrypted objects, key slot, device records and plan from our servers immediately. Local vaults on your devices are untouched and keep working offline. Without the app, follow delete your KeyNesta account.
• Correction: change the email on your account in the same settings screen.
• Objection and restriction: use the app with no account at all, in which case we hold nothing about you beyond the server logs and visit statistics above, for the periods stated.

If you are in a jurisdiction with statutory data rights, such as the EU or UK, you can also exercise them by writing to privacy@keynesta.com, and you have the right to complain to your local data protection authority. Note that we cannot produce the contents of your vault in readable form for anyone, including you, because we cannot decrypt it.

Children

KeyNesta is not directed at children under 13, and you must be at least 13 to create a sync account. We do not knowingly collect data from children under 13. If you believe a child has created a sync account, write to us and we will remove it.

Legal requests

If we receive a valid legal demand for user data, we can only produce what we actually hold: an email address, a password hash, sign-in provider IDs, device records, plan records, ciphertext we cannot decrypt, and logs for the periods above. We cannot hand over vault contents or passphrases, because we do not have them. Where we are permitted to notify you of a request, we will.

Changes to this policy

The dates at the top show when this policy was published and last updated. For changes that meaningfully affect how your data is handled, we will give notice on this site and, if you have a sync account, by email.

Contact

Privacy questions: privacy@keynesta.com. Security reports: security@keynesta.com. The terms of service cover the agreement itself.