Privacy Policy

Effective 5 November 2026 · Applies to KeyBuddy for Mac, iPhone and iPad, and the KeyBuddy browser extension.

1. Who we are

KeyBuddy (“KeyBuddy”, “we”, “us”) makes the KeyBuddy app. Questions about this policy: support@keybuddy.io.

2. Data we collect

None. KeyBuddy does not collect, transmit to us, sell or share any personal data or usage data. The app contains no analytics, crash-reporting, advertising or tracking SDKs, and it does not track you across apps or websites. We don’t ask for your name, email or phone number, and there is no sign-in.

If you email us for support, we receive what you choose to send (your email address and message) and use it only to reply to you.

3. Where your vault lives

On your device

The secrets you save (API keys, tokens, passwords, SSH keys, plus their names, notes and dates) are stored in an encrypted file inside the app’s own container on your device. The file is encrypted with AES-256-GCM using Apple’s CryptoKit. The 256-bit encryption key is created on your device and stored in your Keychain.

In your iCloud (optional)

If iCloud sync is on (you can turn it off in Settings), KeyBuddy saves the already-encrypted vault records to the private database of the KeyBuddy CloudKit container in your own iCloud account, inside CloudKit’s encrypted fields. The encryption key syncs between your devices through iCloud Keychain, which Apple protects with end-to-end encryption. We have no access to your iCloud account, your CloudKit private database or your Keychain, and we cannot decrypt your vault. Apple’s handling of iCloud data is covered by Apple’s Privacy Policy.

Besides the encrypted vault, a short, non-secret identifier of your encryption key is stored with each record so your devices can tell whether they hold the right key. It cannot be used to recover the key.

Settings

App preferences (such as lock timeout, theme, language and the folder you granted access to) are stored locally on your device.

4. Leak scanner and disk cleanup (Mac)

These features only run after you choose your Home folder in a standard macOS dialog. You can revoke access at any time in KeyBuddy’s Settings.

When enabled, KeyBuddy reads the local history and session files of AI coding tools and shells on your Mac, for example:

• Claude Code (~/.claude) and Claude Desktop session folders
• Codex (~/.codex), Gemini CLI / Antigravity (~/.gemini)
• Cursor, VS Code / Copilot and Windsurf workspace storage, Aider chat history
• Shell and REPL history (zsh, bash, fish, Python, Node)

It looks for the secrets in your vault and for well-known key formats. All reading and matching happens on your Mac. File contents are never uploaded or sent anywhere. KeyBuddy keeps a local scan history (dates, file counts, how many keys were found) and small bookkeeping files so it can scan only what changed. When a saved key is found, that finding (which key, which tool, when) becomes part of that key’s record in your encrypted vault, so it syncs to your other devices like the rest of your vault.

Disk cleanup measures the size of AI-tool caches and recordings and, only when you confirm, moves the items you pick to the Trash. It never deletes files permanently.

5. Clipboard

• When you copy a secret from KeyBuddy, it is marked local-only (it does not go to your other devices through Universal Clipboard), expires automatically after the time you choose (30, 60 or 120 seconds), and on Mac is marked as concealed so clipboard managers that respect the convention don’t store it.
• Mac: if “Suggest saving when you copy a key” is on, KeyBuddy checks new clipboard content on your Mac to see whether it looks like a key or a strong password, and offers to save it. Content marked as concealed or transient (for example by password managers) is ignored. Clipboard content is analysed on-device and is never stored unless you choose to save it, and never sent anywhere. You can turn this off in Settings.
• iPhone and iPad: KeyBuddy does not read your clipboard in the background. It only checks whether the clipboard contains text, and reads it when you tap Paste.

6. The kb command and AI agents (Mac)

The optional kb command talks to KeyBuddy through a Unix socket inside the app’s container on your Mac, accessible only to your user account. Each request for a secret asks you to approve with Touch ID (or your Mac password), unless you approved it within the time window you chose. The value is handed to the program you started with kb run. KeyBuddy keeps a short in-app list of recent requests (key name, time, allowed or not). Nothing goes over the network.

7. Browser extension

The KeyBuddy browser extension (for Chrome and Chromium-based browsers such as Edge, Brave and Arc) communicates only with the KeyBuddy app running on your own Mac, over a local connection to 127.0.0.1. It never talks to a KeyBuddy server (there isn’t one), and the app only accepts requests from a paired extension that you approved in KeyBuddy.

• On the page you are on, the extension looks for sign-up and login forms so it can offer a strong password or a saved login.
• It sends the app only what is needed for that: the website’s domain, and the username and password you choose to save. Filling a saved login always requires your approval with Touch ID (or your Mac password) in KeyBuddy.
• It does not collect browsing history, read page content beyond the form fields involved, or send anything to the internet. The only thing it stores in the browser is its pairing token.

8. Network connections

KeyBuddy makes no network connections of its own other than Apple’s CloudKit (for iCloud sync, if enabled). When you tap a link such as “Open the key management page”, the provider’s website opens in your browser; that visit is between you and that website.

9. Notifications, Face ID and Touch ID

Notifications (for example “a key was found in a chat history”) are generated locally on your device. KeyBuddy does not use push notifications from any server of ours; iCloud may wake the app silently to sync. Face ID and Touch ID are handled by Apple’s LocalAuthentication framework; KeyBuddy only receives a yes or no, never your biometric data.

10. Children

KeyBuddy is a developer and productivity tool not directed at children, and it collects no data from anyone.

11. Your choices and your data

Because we hold no data about you, there is nothing for us to export, correct or delete. You are in full control: delete secrets in the app, turn off iCloud sync in Settings, remove KeyBuddy’s data from iCloud in your device’s iCloud settings (Manage Storage), or delete the app to remove its local data.

12. Changes

If this policy changes, we will update this page and the date at the top. If we ever wanted to collect data, we would ask you first in the app.

13. Contact

support@keybuddy.io