Privacy Policy — KeyForge: password manager

Last updated: September 15, 2026

KeyForge: password manager ("KeyForge", "the app") is developed by dev city studio ("we", "us"). This policy applies to the KeyForge browser extension and the KeyForge desktop application.

The short version: KeyForge is local-first. Your passwords, 2FA secrets, and settings are stored only on your own device, encrypted with your PIN. We do not collect, transmit, sell, or share any of your data. There are no accounts, no servers, and no analytics.

What data KeyForge stores

All data is stored locally on your device:

Vault entries — website addresses, usernames, passwords, and optional 2FA (TOTP) secrets you choose to save.
Your PIN verifier — a salted hash used only to check your PIN locally. Your actual PIN is never stored.
Settings — auto-lock timeout, muted sites, and similar preferences.

On the browser extension this data lives in the browser's local extension storage (chrome.storage.local). On the desktop app it lives in an encrypted local vault file in your user profile folder.

How your data is protected

Entries are encrypted at rest with AES-256-GCM, using a key derived from your PIN via PBKDF2 (150,000 iterations).
The decryption key exists only in memory, and only while the vault is unlocked. It auto-locks after your chosen timeout.
Encrypted backups you export are protected by a separate passphrase of your choosing.

Important: because everything is local and encrypted with your PIN, we cannot recover your data if you forget your PIN or lose a backup passphrase. There is no backdoor.

What data we do NOT collect

KeyForge does not collect or transmit:

Passwords, credentials, or vault contents
Browsing history or the websites you visit
Personal information, account details, or contact info
Analytics, telemetry, crash reports, or advertising identifiers

The app makes no network requests. It works entirely offline. (The desktop app can open a link in your default browser only if you click a website link inside it; this passes only the URL you clicked to your browser.)

Permissions and why they're needed

Storage — to save your encrypted vault locally.
Tabs / page access — to detect login forms so KeyForge can offer to save passwords and to fill saved credentials when you ask it to. This processing happens locally in your browser.
Desktop app — reads only its own encrypted vault file on your machine.

Data sharing

We do not share, sell, rent, or transfer any of your data to third parties, because we never receive it in the first place.

Children's privacy

KeyForge does not knowingly collect any personal information from anyone, including children under 13, since no data ever leaves the device.

Changes to your data

You can delete individual entries or your entire vault at any time from within the app. Deleting removes the data from your device permanently. Uninstalling the extension or app removes its local data.

Changes to this policy

If the app's behavior changes, we will update this policy and the "Last updated" date above.

Contact

Questions? Contact us at:

dev city studio
Email: [add your contact email here]