Privacy Policy

Keyrook account · Last updated: 8 November 2026

Changed on 8 November 2026

Families. Up to six people can share items between their apps as a family, made and joined on account.keyrook.com. What a family shares, the names of its shared collections and its keys are encrypted on its people's devices, as everything else is, and we cannot read them. We keep, not encrypted, what makes the family work: its name, who is in it and their role, who invited and confirmed whom and when, invitations by the address they were sent to, emergency access: who named whom, and when it was asked for, refused or handed over, and recovery by an organiser: whether it is on, for the family and for each person, and who asked for help and who helped. The people in your family see your email address, your name if you gave one, and your role. Starting your account over takes you out of your family, as leaving does; if you were its only organiser, the first of its people to change its keys takes your place. An organiser can delete the family, with all it shares, for everyone; each of its people is emailed. The file you can download on account.keyrook.com holds your family, your place in it and your emergency access.
Recovery by an organiser. If you turn it on for yourself, once an organiser has turned it on for the family, your account's key is kept sealed so that only your family's organisers' devices open it. If you lose your password and your recovery key, one of them can help you back in: you ask from a new browser, the two of you compare a code, and your account then gets new keys at once. You are emailed each time an organiser opens your account's key. While they are an organiser they can open it; when one who could stops being an organiser, it is turned off for everyone, and you can turn it on again. Once your emergency contact or an organiser has opened your account's key, account.keyrook.com and your apps ask you to replace your account's keys, until you do.
More emails: an invitation, to the address invited; to a family's organisers, when someone accepts; to someone removed from a family; to a family's people, when its only organiser starts their account over; with emergency access, when it is asked for and when it is refused; and, with recovery by an organiser, a code to ask for help, a notice to the organisers when someone asks, notices to you each time an organiser opens your account's key and when you are back in, and one to each person who turned it on when it is turned off; and, when an organiser deletes a family, to each of its people.

Changed on 27 October 2026

An email for each sign-in. Each time your account is signed in to, in an app or on account.keyrook.com, we email you which app and device, how, from which country and when, so that a sign-in you did not make does not go unnoticed. Making an account sends none.
Download what we hold. On account.keyrook.com you can download, as a file, what we hold about your account: your address and name, how you sign in, your passkeys, whether two-step sign-in is on, your apps and how many entries each syncs, your devices, and the dates we keep. None of the keys, proofs or encrypted data we keep is in it: they open nothing for you, and each app exports what it syncs, decrypted, on your device.
Changing your address. You can change your account's email address on account.keyrook.com, with your password, or Google or GitHub, and a code sent to the new address. We keep the old address for 30 days, so that a change you did not make can be put back, and we email both addresses. Nothing that opens your data depends on your address, so none of your keys changes.
Recent activity. For 90 days we keep a short history of each sign-in and each change to how your account is reached or opened: what happened, when, which app and device, how you signed in, and the country the request came from, as our network provider reports it. Never the network address itself. You see it on account.keyrook.com, under Recent activity.
How changes are told. A change in what we collect is now listed here from the day it takes effect, rather than announced on account.keyrook.com before. If we ever want to use what you have already given us for something this policy does not describe, we tell you before we do.

Changed on 26 October 2026

Removing a device. When you remove a device from your account, we keep a record of it for 180 days: which app it was, its device identifier, when it was removed, the proof your app's key made (we can neither make nor read it), and scrambled forms of that device's session tokens, so that it can be told when it next connects. It is deleted with your account.
One more email: when a device is removed with that proof.

Changed on 24 October 2026

Your name, if you give one (from 24 October 2026). You can give your account a name on account.keyrook.com, or in an app that offers it, to be greeted by on that page and at the top of our emails. It is optional, we never take it from Google or GitHub, and we keep nothing for it until you give one.
One name for one thing: this policy now says your recovery key, as the apps always have, for the key you keep on paper. The six digits we email you are a code.

Changed on 22 October 2026

One account, several ways to sign in. An account with a password can also sign in with Google or GitHub, added on account.keyrook.com with the password, and an account made with Google or GitHub can have a password added. For each Google or GitHub account added, we keep what we always keep for one: the identifier it gives your account and the verified email address it reports. It can be removed again, as long as another way to sign in is left.
Two-step sign-in, if you turn it on. Once account.keyrook.com offers it, you can ask for a code from an authenticator app after your password, or after Google or GitHub. If you turn it on, we keep the secret that app shares with us, sealed with a key held apart from the database. It is off unless you turn it on, and we keep nothing for it until then.
More emails: when your recovery key is changed; when Google or GitHub is added to your account or removed from it, and when a password is added; and, with two-step sign-in, when it is turned on or off, and when your recovery key is used in place of a code.

Changed on 21 October 2026

Starting over waits a week. A start over asked for with the email alone takes effect a week after it is asked for. Until then nothing changes, every device stays signed in, and any of them can cancel it. Meanwhile we keep what the request brings, sealed: the new password's proof and the new keys.
Your recovery key's last check. We note the date your recovery key last proved it opens your account, so that the page and the apps can remind you to look for it.
Three more emails: when a start over is asked for, the day before it takes effect, and if it is cancelled.
Passkeys. You can sign in with a passkey (Face ID, a fingerprint, a PIN or a security key) instead of your password. For each passkey you add we keep its public key and identifier, the name you give it, whether it is synced to your other devices, a counter it reports, and when it was added and last used.
A passkey can unlock your data. When your passkey supports it, it also opens your account's key, in your browser. We keep your account's key encrypted under a key that only that passkey produces, on your device; we never receive that key. A passkey kept by iCloud Keychain, Google Password Manager or another passkey manager is on your other devices too, protected by that service.
Two more emails: when a passkey is added to your account, and when one is removed.

A Keyrook account is one account for Keyrook's apps: Keyrook Authenticator and Passhold sign in with it. What those apps sync between your devices is encrypted on your device, with keys the server never receives, before it is uploaded: we store it, but we cannot read it. We keep your email address and what is needed to run the account, use it for nothing else, and sell nothing. You can sign in with a password; with a passkey, from 21 October 2026; or with Google or GitHub, which tell us who you are and nothing more. One account can have several of these.

The Keyrook account is run by BRICK IT ALL LLC ("we"). This policy covers the account, its server at api.keyrook.com and its page at account.keyrook.com. What each app keeps on your device, and what it syncs, is described in that app's own privacy policy.

What we receive and keep

Your email address, to identify your account and to send you a code that proves the address is yours. If you sign in with Google or GitHub, the address comes from them, already verified.
Your name, if you give one (from 24 October 2026): the name you give your account on account.keyrook.com or in an app, to greet you on that page and in our emails. It opens nothing, so we keep it as you typed it, not encrypted. We never take it from Google or GitHub.
Your previous address, for 30 days (from 27 October 2026): when you change your account's address, the old one, so that a change you did not make can be put back if you write to us from it.
If you sign in with Google or GitHub: who you are there. The identifier that provider gives your account (a number, not your name) and the verified email address it reports. We ask Google for openid email and GitHub for user:email, nothing more; we use the answer once to sign you in and keep no access token, so we cannot read your mail, your files or your repositories, or act for you anywhere. An account made this way has no password until you add one, and we store nothing that could stand in for one. You can also add Google or GitHub to an account that has a password, if it reports the same email address, and remove it while another way to sign in is left. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What lets you sign in, none of it usable as your password. If your account has a password, it never leaves your device. It is stretched on your device into two unrelated keys: one stays there; the other proves your password to us, and we store only a salted, slow hash of that proof, mixed with a secret held apart from the database.
Your passkeys (from 21 October 2026). For each passkey you add: its public key and identifier, the name you give it, whether it is kept by a service that copies it to your other devices, a counter it reports, and when it was added and last used; and for your account, a random identifier your passkeys carry instead of your email address. A passkey's private key stays on your device or with your passkey manager, and we never receive it. While you add or use one, we hold a one-time challenge for five minutes.
Two-step sign-in, if you turn it on. The secret your authenticator app shares with us, the last 30-second period a code was taken for, so that no code works twice, and when you set it up and turned it on. We keep the secret sealed with a key held apart from the database, but unlike your account's keys it is not hidden from the server: checking your codes needs it. It only tells a right code from a wrong one, and opens none of your data. Between the first step of a sign-in and its second, we hold for five minutes which device and app it is for, and whether it began with a password or with Google or GitHub.
Your account's keys, which we cannot open. Your account has a key of its own, and each app a key of its own sealed to it. We store the account's key only in encrypted form: once under a key made from your password, once under your recovery key, and, from 21 October 2026, once under each passkey that can unlock it, with a key only that passkey produces on your device, which we never receive. Your recovery key never leaves your device; we keep only a hashed proof of it, as we do for your password.
When your recovery key last proved it still works (from 21 October 2026): the date it last opened your account's key, typed whole on a device to check it, or used to set a new password. Only so that you can be reminded to look for it; we decide nothing by it.
What your apps sync, encrypted. Each app encrypts what it syncs on your device before it is uploaded. We store the ciphertext and the little we need to keep your devices in step: a random identifier for each entry, a revision number, when it last changed, whether it was deleted, and which of your devices changed it. We cannot read what the entries hold.
Your signed-in devices: a name such as "Chrome on Mac", which app it is, when each signed in and was last used, and a hash of its session tokens, so you can see the list and sign a device out.
Devices you remove (from 26 October 2026): a record of each removal, kept 180 days: which app it was, its device identifier, when it was removed, the proof your app's key made (we can neither make nor read it), and scrambled forms of that device's session tokens, so that it can be told when it next connects.
Recent activity (from 27 October 2026): for each sign-in and each change to how your account is reached or opened (a password, a passkey, a way to sign in, your recovery key, two-step sign-in, a device removed, your address, a start over), what it was, when, the app and the device's name, how a sign-in was made, a passkey's or provider's name where it is about one, and the country the request came from. Never the network address, and never an email address.
A family, if you make or join one (from 8 November 2026): its name; for each person in it, their role (organiser or member), when they joined, who confirmed them and when, and whether the code on both screens was compared, and when it was, the organiser's word of it to each person in the family, a check only the organiser and that person can make, kept while the three of them are in the family; the public half of each person's key for the family, and its private half sealed so that only that person's devices open it; the family's list of who is in it, with a check that only its people's devices can make or verify; and the family's keys, each sealed to the person it is for. For what the family shares: which app each shared collection is for, who made it and when, and its name and the list of who holds its key, both sealed under the collection's own key; and for each shared item what we keep for your own, a random identifier, a revision number, when it last changed, whether it was deleted and which device changed it, with what it holds encrypted. We cannot open anything sealed or encrypted here. So that account.keyrook.com can tell if we ever changed who is in your family or their keys, it keeps what it last saw of them: in that browser's local storage (who was in it and the public half of each key, nothing secret, never sent to us), and with us, sealed under a key only your account's key makes, until that key is replaced.
An invitation to a family (from 8 November 2026): the email address an organiser typed, whether or not it has an account yet, the role offered, who sent it and when it ends. It carries no link and no secret: the account that proves that address finds it.
Emergency access, if you turn it on (from 8 November 2026): who in your family you named; your account's key, sealed by your device so that only their devices open it, which we cannot open; and when they asked for it, when you refused, and when it was handed over. It is handed over to them alone, a week after they ask, unless you refuse before then.
Recovery by an organiser, if you turn it on (from 8 November 2026): that it is on for your family, and for you; your account's key, sealed by your device so that only your family's organisers' devices open it, which we cannot open; and, when you ask for help, the key the new browser made for that request, which organiser helped and when, and your account's key sealed by their device for that browser alone.
When someone else opened your account's key (from 8 November 2026): your emergency contact, once it was handed over, or an organiser helping you back in; who, in which family, and when.
When you left a family (from 8 November 2026), were removed from it once confirmed, started your account over in it, or deleted it: which family and when, since another family can be joined only 12 months later.
A new browser asking to join. A browser signed in with Google or GitHub gets your data only when one already signed in approves it. Until then we hold its name and a one-time public key; once you approve, a key encrypted for that browser alone, which we cannot open. The request is deleted when it is used or declined, and stops working after ten minutes.
Starting your account over. If you lose both your password and your recovery key, you can start your account over with your email address alone. From 21 October 2026 it takes effect a week after you ask: until then we keep what the request brings (the new password's proof and the new keys, sealed as your keys always are), nothing else changes, and any device still signed in can cancel it. Once it takes effect, your passkeys are removed (from 21 October 2026), two-step sign-in is turned off, and what your account held is kept, still encrypted, for 90 days, so that your old password, your old recovery code or a device still signed in can bring it back. We email you a week before it is deleted. From 8 November 2026, it also takes you out of your family, as leaving does, since your keys for it open only with your old ones; its organisers can invite you back.

The account page

account.keyrook.com runs in your browser. A password or recovery key you type there, and what a passkey answers there, are used in your browser to open your account's keys and are never sent to us: only the proofs described above are. A code from your authenticator app is sent to us, as it must be to be checked; the QR code that sets two-step sign-in up is drawn by the page itself, in your browser. The page keeps its session (its tokens, your account's identifier and email address, and an identifier for the tab) in that tab's session storage until you close the tab, and for at most one hour. It sets no cookies, has no analytics, and loads no scripts, fonts or styles from anywhere else.

What the service sees in passing

Your IP address, which every connection carries. To limit abuse (someone guessing passwords or requesting codes in bulk), the server counts recent requests per address. It keeps only a one-way digest of the address, for at most an hour.
The country a request came from (from 27 October 2026): our network provider works it out from your IP address and tells us, as two letters. We keep it with your recent activity, and never the address.
Signing in with Google or GitHub happens on their site, under their privacy policy, and they learn that you signed in to Keyrook.
Using a passkey happens in your browser and with your passkey manager (such as Apple, Google, Microsoft or a password manager), under its own privacy policy. Your browser sends us only the passkey's signed answer to our challenge.
Requests pass through a network provider that protects the service and sees connection details such as your IP address. It and the server write routine access logs (IP address, time, the address requested); we keep no archive of them, and we do not combine them with your account.

Emails we send

Only what the account needs:

a code that confirms your address when you sign up, and a notice if someone tries to sign up with an address that already has an account;
a code to set a new password when you have forgotten yours;
a code to replace your account's keys, and a notice once they were replaced;
a notice when your recovery key is changed;
a notice when Google or GitHub is added to your account or removed from it, and when a password is added;
a code to start your account over; from 21 October 2026, a notice when it is asked for, a reminder the day before it takes effect, and a notice if it is cancelled; a notice once it was started over, and a reminder a week before what it held is deleted.
from 21 October 2026, a notice when a passkey is added to your account, and when one is removed;
from 27 October 2026, when you change your address: a code to the new address, or a notice there if it already has an account; then a notice to both addresses once it changed;
from 26 October 2026, a notice when a device is removed from your account with a proof that lets its app take your data off it;
from 27 October 2026, a notice each time your account is signed in to, saying which app and device, how, the country and when;
from 8 November 2026, in a family: an invitation, to the address invited; to its organisers, a notice when someone accepts; a notice to someone an organiser removes; a notice to its people when its only organiser starts their account over; with emergency access, a notice when your contact asks for it, saying the day it opens, and one to them if you refuse; and, with recovery by an organiser, the code to ask for help, a notice to the organisers when you ask, one to you each time an organiser opens your account's key and when you are back in, and one when it is turned off; and a notice to its people when an organiser deletes it;
if you turn on two-step sign-in, a notice when it is turned on, when it is turned off, and when your recovery code is used in place of a code.

No newsletters, no marketing.

Who processes it for us

A hosting provider runs the server, its database and the account page.
A network provider carries and protects the connections between your browser and the server.
An email delivery service sends the emails above.
An email provider holds an off-site copy of each daily database backup. The backup is encrypted, and the key to open it is not stored with it.

They handle the data only to provide those services to us. Some of them are in the United States, so your data may be processed outside your country. To know which companies they are, write to us.

How long we keep it

Your account and everything synced: until you delete the account. Deleting it, on account.keyrook.com or in an app, with your password or by signing in with Google or GitHub again, removes at once your email address, your name, your account's keys, your passkeys, your two-step sign-in, everything every app synced, your devices, and anything kept from before you started over.
A start over asked for (from 21 October 2026): until it takes effect a week later, or is cancelled.
What was kept after starting over: 90 days, then it is deleted.
When your recovery key last proved it works: until you delete the account.
Your name: until you change or remove it, or delete the account.
Recent activity (from 27 October 2026): 90 days, then it is deleted; at once if you delete the account.
Your previous address (from 27 October 2026): 30 days after you change it, then it is deleted; at once if you delete the account.
A family (from 8 November 2026): until an organiser deletes it, or the last person in it leaves, or the last one confirmed in it, and then it is deleted at once, with all it shares. Your place in it, your keys for it and your emergency access are deleted when you leave, are removed, start the account over or delete it; what you put in its shared collections stays the family's. Your account's random identifier stays as who made the family or one of its collections, with nothing else about you.
An invitation to a family (from 8 November 2026): until it is accepted, declined or withdrawn, or 7 days, then it is deleted within a day.
When you left a family (from 8 November 2026): 12 months, then it is deleted within a day; at once if you delete the account.
Recovery by an organiser (from 8 November 2026): your account's key kept for the organisers, until you turn it off, an organiser turns it off for the family, one who could open it stops being an organiser, or your account gets new keys; a request for help, an hour, then it is deleted within a day.
When someone else opened your account's key (from 8 November 2026): until your account gets new keys, then it is deleted at once.
A device you removed (from 26 October 2026): 180 days, or until you delete the account or it starts over.
Your passkeys (from 21 October 2026): until you remove one, delete the account, or the account starts over.
Two-step sign-in: until you turn it off, delete the account, or the account starts over. One set up but never confirmed with a code is deleted within a day.
Backups: encrypted daily copies of the database are kept for 14 days on the server, and the off-site copies are deleted within 60 days. Deleted accounts disappear from backups as they expire.
Sign-ins in progress: a Google or GitHub sign-in that has not finished, and a request to join from a new browser, stop working after ten minutes; a passkey's challenge, and a sign-in waiting for its second step, after five. Each is deleted within a day.
Codes: a code works for 15 minutes. The record of the request, with the address it went to, is deleted within a day once its hour has passed.
Failed sign-in counts are forgotten after an hour without failures, and deleted within a day after that. Expired sessions are deleted within a day.

How we use it

Only to provide the account and sync, and to keep the service and your account secure. We do not sell your data, use it for advertising, share it except with the processors above and, in a family, with its people as said above, or use it to decide anyone's creditworthiness. Nobody at BRICK IT ALL LLC reads what your apps sync, because nobody can.

Your choices and rights

See it. account.keyrook.com shows your name, how you sign in, whether two-step sign-in is on, your apps, your devices and your passkeys; your apps show what they sync. account.keyrook.com also shows the sign-ins and changes of the last 90 days. For what we hold about your account, write to us. You can also download it, as a file, on account.keyrook.com. The page and the file also show your family, who is in it, your emergency access, and whether an organiser can help you back in.
Delete it at any time on account.keyrook.com. If you are the only organiser of a family others are still in, make one of them an organiser first, or remove them.
Leave a family (from 8 November 2026) at any time on account.keyrook.com, where you can also change or take back your emergency contact, or refuse their request. An organiser removes others there too. What the family's people already saw, they may have kept.
Correct it. Change or remove your name on account.keyrook.com. Change your email address there too.
If you believe we handle your data wrongly, you may also complain to the data protection authority where you live.

The Keyrook account is not directed at children under 13, and we do not knowingly hold data about them.

Changes

When this policy changes, the date at the top changes with it, and what changed is listed at the top from the day it takes effect. If we ever want to use what you have already given us for something this policy does not describe, we tell you before we do, and ask for your consent where it is needed.

Contact

BRICK IT ALL LLC — brickitall.hi@gmail.com