Legal
Privacy Policy
Last updated: 10 October 2026 | Version 2.0
The short version
- Your codes, notes and locations are stored on your devices, not on our servers. We don’t have any servers for your data.
- There’s no account, no advertising and no tracking. We never sell or share personal information.
- Backups are encrypted on your phone with your passphrase before they’re saved to iCloud Drive or the folder you choose. We can’t read them.
- Your location is used on your device to find the nearest code. It isn’t sent to us.
CodeKeep is made by Tallahootie Ltd (“we”, “us”). CodeKeep respects your privacy. This Privacy Policy explains how the CodeKeep apps for iPhone and Apple Watch, the CodeKeep apps for Android and Wear OS, and this website, handle your information. By using CodeKeep, you agree to the practices described here.
Information We Collect
CodeKeep does not collect, store or process any personally identifiable information. There’s no account to create, and the app doesn’t send your codes, notes, locations or settings to us. CodeKeep is ad-free and contains no advertising or tracking software, so we don’t track you across other apps or websites, and we never sell personal information to anyone.
Information Stored on Your Devices
Everything you add to CodeKeep (code names, codes, categories, notes, places and map pins) is stored on your device. Your preferences, such as the default location for new codes, are stored in the app’s settings on your device.
On iPhone, your codes are stored in the iPhone Keychain, which iOS encrypts and only makes readable while your iPhone is unlocked. On Android, they’re stored in CodeKeep’s private app storage, encrypted with AES-256 using a key held in the Android Keystore, in your phone’s secure hardware where it has it. Android’s own app backup is turned off for CodeKeep, so your codes aren’t copied to Google’s backup service.
If you turn on Secure App Access, CodeKeep asks your device to check your face, fingerprint or passcode (Face ID or Touch ID on Apple devices, or your fingerprint, face or screen lock on Android). This is handled entirely by the operating system. CodeKeep never receives your biometric data.
Location
If you allow it, CodeKeep uses your location while the app is in use to show the codes nearest to you, measure distances and place map pins. Your location is used on your device and is not sent to us.
On Apple devices, maps, addresses and directions are provided by Apple Maps. To show an address for a code, CodeKeep sends that code’s map coordinates (not the code itself) to Apple. Directions open in the Apple Maps app. Apple’s use of this information is covered by Apple’s Privacy Policy.
On Android, your location comes from Google Play services on your phone, and maps are provided by Google Maps, which loads map data from Google for the area you’re viewing. To show an address for a code, CodeKeep sends that code’s map coordinates (not the code itself) to your phone’s address lookup service, which is usually provided by Google. Directions open in Google Maps, and the Maps button opens your maps app with the code’s coordinates and name, never the code itself. Google’s use of this information is covered by Google’s Privacy Policy.
Encrypted Backup
Encrypted backup is optional and off until you turn it on. When it’s on, CodeKeep encrypts your codes on your device using AES-256 with a key derived from your passphrase, then saves the encrypted file. We have no access to your backup or your passphrase, and nobody can read the file without your passphrase.
On Apple devices, the backup is saved to your own iCloud Drive, and we have no access to your iCloud account. If you choose to save your passphrase to iCloud Keychain, it’s stored by Apple in your iCloud Keychain, which is end-to-end encrypted.
On Android, the backup is saved to a folder you choose, either on your phone or in a cloud storage app such as Google Drive, Dropbox or OneDrive. That provider stores the encrypted file under its own privacy policy, but can’t read your codes.
You can delete your backup at any time from Settings.
Data Export and Import
You can export your codes from Settings › Data Export. Encrypted exports are protected with your passphrase. Unencrypted exports (CSV, JSON or plain text) can be read by anyone who has the file. Exported files are created on your device and go only where you choose to save or share them. An encrypted export made on iPhone can be imported on Android, and the other way round.
Apple Watch and Wear OS
If you use the Apple Watch app, your iPhone sends your codes directly to your paired Apple Watch using Apple’s Watch Connectivity framework. On the watch, codes are stored in the watch’s Keychain so the app works without your iPhone.
If you use the Wear OS app, your Android phone sends your codes to your paired watch using Google’s Wearable Data Layer, which encrypts them between your devices. On the watch, codes are stored encrypted with a key in the watch’s Keystore, and are only shown if the watch has a screen lock. The Tile and complication use a separate copy that contains code names and places, never the codes. Turning off syncing in Settings › Wear OS removes your codes from the watch.
Codes are never sent to us.
Nearest Code Widget and CarPlay
The Nearest Code widget is off until you turn on Settings › Widget › Show Nearest Code. When it’s on, a copy of the codes that have a saved location, in the categories you choose, is kept where the widget can read it, including while your phone is locked. On iPhone, that’s a protected area of the Keychain, which lets the widget show the nearest code on your Home Screen, and in CarPlay while your iPhone is locked. On Android, the copy is encrypted with a key in the Android Keystore. Turning the widget off removes that copy.
Clipboard
When you copy a code, it’s placed on your clipboard for one minute. On iPhone, it’s never shared with your other devices through Universal Clipboard. On Android, it’s marked as sensitive so Android hides it in clipboard previews, and CodeKeep clears it after one minute unless you’ve copied something else since.
Data Collected for User Trends, Purchases, and Feedback
Apple and Google provide us with aggregated App Store and Google Play information, such as the number of downloads, and crash reports if you’ve chosen to share usage and diagnostics data with app developers. This information doesn’t identify you.
| Data Type | Purpose | Privacy Considerations |
|---|---|---|
| App Units | Track initial downloads of the app to understand popularity and trends. | Collected in aggregate, without identifying individual users. |
| Active Devices | Count devices with the app installed and opened, indicating active user base size. | Aggregate data only, no personally identifiable information (PII). |
| Sessions | Measure app usage frequency, showing user engagement levels. | Tracked anonymously and aggregated, without user identifiers. |
| Retention Rate | Monitor user retention over time (e.g., 7-day, 30-day retention rates). | No individual tracking; data is aggregated for trends. |
| Revenue and Purchases | Track app revenue. | Revenue data is aggregated by Apple and Google and not linked to specific users. |
| Source Type | Identify app discovery sources (e.g., search, referral links). | No user-specific tracking, provided as aggregate data. |
| Crash Data | Help improve app stability by identifying issues. | Crash reports are anonymised, not tied to any individual user. |
| Device Model and OS Version | Optimise app for popular device models and OS versions. | No personal identifiers; aggregate data only. |
| Country and Language | Understand geographic and language distribution of users. | Tracked in aggregate without linking to individual users. |
Data Tracked on This Website Using Web Analytics
This website is hosted by Vercel and uses Vercel Web Analytics to count visits. It doesn’t use third-party cookies, and the data it records isn’t tied to any individual or IP address. Visitors are counted using an anonymous identifier created from the request, which is discarded after 24 hours.
| Data Type | Purpose | Privacy Considerations |
|---|---|---|
| Page Views | Track the pages visited to understand user engagement and content popularity. | Collected anonymously with no personal data. |
| Referring Websites | Understand how users find the site, whether through search engines or referrals. | Aggregate data, no user identification. |
| Approximate Location | Understand where visitors come from (country, region and city). | Not tied to any individual or IP address; data is aggregated. |
| Device, Operating System and Browser | Identify which devices (desktop, mobile, tablet), operating systems and browsers are used to access the site. | Data is aggregate and anonymous, not tied to specific users. |
Upgrade Requests and Support Emails
If you email us, for example to claim a free upgrade from CodeKeep Version 1 or to ask for help, we receive your email address and anything you include, such as your App Store or Google Play receipt. We only use this to reply to you and to send you a promo code, and we don’t add you to any mailing list.
Third Parties
CodeKeep doesn’t include any third-party analytics, advertising or tracking services. On Apple devices, it uses Apple’s own frameworks for maps, iCloud and Apple Watch. On Android, it uses Google Play services for location, Google Maps and Wear OS. On both, an open-source library (ZipArchive on Apple devices, zip4j on Android) creates password-protected ZIP exports on your device.
Deleting Your Data
Because your data is on your devices, you’re in control of it. Use Delete All Codes in Settings to remove every code from your device, and the backup deletion option (iCloud Backup Deletion on iPhone, Backup Deletion on Android) to remove your backup. On iPhone, we recommend deleting your codes in the app before deleting CodeKeep, as iOS may keep Keychain data after an app is removed. On Android, uninstalling CodeKeep removes everything it stored on your phone, but not a backup in the folder you chose. You can turn off location access at any time in your device’s Settings app.
Children
CodeKeep doesn’t knowingly collect any information from anyone, including children.
Data Security
Since CodeKeep does not collect or store your personal data, there is no personal data held by us that could be at risk. We prioritise secure development practices and strong encryption to keep the data on your devices safe.
Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes to CodeKeep or our practices. This page will always show the latest version. Previous versions are available at the links below:
- Version 1.0 (1 June 2025, CodeKeep Version 1)
Contact Us
If you have any questions about this Privacy Policy, please contact us at support@codekeep.app.