Keybound Privacy Policy
In short
Keybound is an offline paperwork vault. Keybound does not have the internet permission, does not have the camera permission, has no Keybound account, and shows no ads. Your files, your vault password and your recovery key stay on your phone, encrypted with keys only you hold. G&R Mad Lab 42 LLC never receives them.
Who we are
G&R Mad Lab 42 LLC makes Keybound. This policy covers the Keybound Android app. It does not cover other websites, email you send us, or apps not named here.
Information we do not collect
G&R Mad Lab 42 LLC does not collect, receive, sell, or share:
- Your vault contents: documents, photos, scans, notes, Key vault entries, collection items, books, trackers, or any other records
- Your vault password, recovery key, password hint, or fingerprint / face data (fingerprint and screen lock checks are done by Android and never seen by Keybound)
- Your name, email address, phone number, or payment card details (there is no Keybound account)
- Your location, contacts, or advertising ID
- Analytics, usage statistics, or crash reports sent to us
Android's automatic cloud backup of Keybound is turned off, so the vault is not copied to any cloud by Android.
Permissions Keybound uses, and why
These work on your phone only. None of them send your information to us.
- Fingerprint / screen lock (USE_BIOMETRIC, USE_FINGERPRINT): to unlock the vault on this phone.
- Notifications (POST_NOTIFICATIONS) and start at boot (RECEIVE_BOOT_COMPLETED): so reminders you set still work after the phone restarts. Notifications never show what a reminder is about.
- Calendar (READ_CALENDAR, WRITE_CALENDAR): asked for only if you turn on "Put it on my phone calendar". Dates go to a calendar on this phone.
- NFC (NFC): used only while the "Use your security key" window is open, to read an answer from a YubiKey you hold to the phone for a Dead Drop. Nothing is sent anywhere. A security key plugged into the USB port uses Android's own "allow this app" question instead of a permission.
- Hide other apps' floating windows (HIDE_OVERLAY_WINDOWS): a safety feature that blocks screen overlays while Keybound is open.
- Google Play billing (com.android.vending.BILLING): to buy the one-time Basic or Everything unlock through the Google Play Store app. This is not the internet permission.
The "Share Keybound with a friend" and "Rate Keybound" buttons only open your phone's share sheet or the Google Play Store app. Keybound does not see who you share with or what rating you give.
How your information is stored
Files in the vault are encrypted on your phone. Unlocking takes your vault password plus your phone's fingerprint or screen lock (or your recovery key). Extra secure mode, folder passwords, a password hint, and encrypted backup files are optional tools you control.
We cannot open your vault. There is no email reset and no back door. Keybound never deletes your vault on its own.
Purchases
Keybound offers one-time unlocks (Basic and Everything, and an upgrade from Basic to Everything) through Google Play. Google Play handles the payment under Google's Privacy Policy. Keybound never sees your card details. The app asks the Google Play Store app on your phone which unlocks you own and keeps that answer on the phone so your unlocks keep working offline. Keybound does not send purchase information to us. Google may share basic order details with us as the seller (for example an order number, the product, and the date) so we can handle refunds and tax records; we use them only for that.
Google Play services features on your phone
Some optional tools use features built into Google Play services on your phone: the document scanner, the QR code scanner for box labels, and reading the words in your scans. These run on the phone, and Keybound does not send your pictures or words anywhere. Google Play services may send basic diagnostic information (for example device model, app version, and error codes) to Google under Google's Privacy Policy. It does not include your documents. If you prefer, you can skip these optional tools; the vault works without them.
Sharing files
Keybound does not upload your files. If you use Android's share, print, fax, or "share with a password" features, you are sending a file you picked to an app or person you chose. That sharing is under your control and is not a transfer to G&R Mad Lab 42 LLC.
Backups and uninstalling
You can make an encrypted backup file and keep it somewhere you trust, such as a USB stick or your computer. Only the recovery key of the vault it came from opens that file.
If you uninstall Keybound or reset the phone, the vault on that phone is deleted by Android. The recovery key alone cannot bring it back. Keep the encrypted backup file and the recovery key if you want a way to restore.
Deleting your information
Everything Keybound keeps is on your phone. You can delete any file in the app, or uninstall Keybound to remove the vault. We hold no copy, so there is nothing for us to delete. For a Google Play purchase or refund, contact Google Play or email us.
Children
Keybound is meant for adults managing household and business paperwork. It is not directed to children under 13, and we do not knowingly collect personal information from anyone, including children.
Security
We test Keybound's security before each release and fix problems in updates. If you think you found a security problem, please email gnrmadlab42@gmail.com.
Changes to this policy
If this policy changes, we will update the effective date at the top of this page and post the new text here.
Contact
G&R Mad Lab 42 LLC
Email: gnrmadlab42@gmail.com