Passkey privacy policy

Last updated: September 23, 2026

Passkey turns your Android device into a security key for your own computer. This policy explains what the app does with data. In short: nothing leaves your devices.

What the app stores

• The cryptographic keys it creates for your computer and for websites. They are generated in Android's hardware-backed keystore and cannot be exported, not even by the app.
• For each key: the website or computer it belongs to, the account name the website gave, and a signature counter. This stays in the app's private storage on your device.

What the app sends, and where

Only to your own computer, over a USB cable or Bluetooth, and only the answers to sign-in requests that computer asks for (a public key when you register, a signature when you sign in). The app has no internet permission: it cannot contact any server, including ours.

What the app does not do

• No accounts, analytics, advertising, tracking or crash reporting.
• No data is collected by us or shared with anyone.
• Your fingerprint never reaches the app. Android checks it and only tells the app whether it matched.

Permissions

• Bluetooth: to connect to a computer you paired.
• Notifications: to show sign-in requests.
• Display over other apps (optional): to open the fingerprint prompt by itself.
• Foreground service: to stay connected to your computer.

Deleting your data

Delete a key in the app (tap it under "Saved keys"), or uninstall the app to remove all keys.

Contact

Questions: mahirsn@mahirsn.net