Last updated: October 2026
KeyLockr is committed to protecting your privacy. We use end-to-end encryption (E2EE) to ensure that only you can access your data. We cannot read or decrypt your passwords, notes, or even item metadata such as titles, website URLs, and 2FA labels — these are encrypted on your device with your Account Key.
KeyLockr operates on a zero-knowledge architecture. Vault content is encrypted on your device before being sent to our servers, and we store that content only as ciphertext we cannot decrypt. To authenticate accounts, synchronize devices, and deliver notifications, the service also retains account identifiers, public keys, and necessary device, routing, and version metadata. Unencrypted encryption keys never reach our servers; when syncing devices or sharing files requires key delivery, we only relay or store encrypted key envelopes created by your devices, which only authorized devices or recipients can open.
After the alias migration is complete, the live account database stores keyed hashes (HMAC) and masked display fragments instead of full plaintext email addresses or phone numbers. If both the key and database are compromised, low-entropy numbers may still be recovered by guessing, so keys and database data are kept separately.
Verification records created before migration may remain for up to one hour. Legacy block records remain until their original expiry, up to 24 hours; permanent blocks remain until the later cleanup phase. Earlier database dumps, pgBackRest backups and WAL may still contain plaintext until their retention periods expire. These retained records are outside the statement about the migrated live account database.
IP fields persisted in the database are encrypted with the server key. Rate limits, blocking and short-lived records used to show a sign-in source may still use IP addresses; this does not mean every temporary IP record is encrypted.
We send transactional SMS messages (verification codes, security alerts) only when you provide your phone number and consent during registration. We do not send marketing messages. Standard message and data rates may apply. Reply STOP to opt out. See our SMS Terms of Service.
KeyLockr is a general-audience service and is not directed to children. We do not knowingly collect personal information from children under 13, or under 16 in the European Economic Area, or under the higher age of digital consent where you live. If we learn that we have collected such information, we will delete the account and its associated data. If you believe a child has provided us with personal information, please let us know using the contact below.
For privacy-related questions, please contact us:
infosafex.cloud