Privacy policy

Vault data

Vault data — your logins, notes, cards, identities, and categories — is stored locally on your Mac, encrypted at rest (Argon2id key derivation and AES-256-GCM). Bevel Keys does not require a Bevel Keys cloud account to unlock the vault, and we cannot read your vault from this website.

What the Mac app may send off-device

Day-to-day vault use does not upload passwords. The Mac app only uses the network for the following, all optional or purchase-related:

• App Store / StoreKit. Buy and restore Premium go through Apple. We do not receive your payment card details.
• In-app contact. Settings → Contact posts the name, email, subject, and message you type to https://bevelkeys.com/api/v1/contact so we can reply. Do not put vault secrets in that form.
• Password-change reminders (opt-in). If you enable reminder email in Settings, we send a count-only nudge (“you have N passwords you wanted to update”). It does not include passwords, usernames, or URLs.
• Pwned Passwords scan (Premium). An optional Have I Been Pwned range check sends only the first five characters of a SHA-1 password hash (k-anonymity). It never sends the password, email, or username. It does not look up whether your email appeared in a breach.
• iCloud Sync (Premium, off by default). If you choose to turn sync on in Settings, the still-encrypted vault package can copy through your iCloud Drive container so another Mac on the same Apple ID can use it. This is not automatic background sync of plaintext, and it is not a Bevel Keys server. Unlock stays local.

Browsers

Safari AutoFill uses Apple’s credential-provider extension on this Mac. Chrome and Brave fill/save use an optional native-messaging helper that you enable in Settings; that may write a host manifest into that browser’s Application Support folder. The Chrome/Brave extension is distributed separately via the Chrome Web Store.

Cookies and analytics (this website)

We show a cookie consent popup (free CookieConsent library). Analytics cookies are set only if you choose Accept.

• Essential / functional. Theme preference and remembering your cookie choice (local storage / consent cookie).
• Analytics (optional). Google Analytics 4 (G-D39W5ZKML0) measures visits and page views. These load only after you accept.

Vault data on your Mac is never collected by this website. You can decline analytics on the banner or clear site data in your browser.

What we can't see

We cannot read your vault from the website. There is no server-side copy of your passwords for us to access, lose, or be compelled to hand over. iCloud copies, if you enable sync, live in your Apple account, still encrypted.

Contact

Questions about this policy: Foribus — email hi@bevelkeys.com or use the form on the About page.