IronStorage for Android — Privacy policy
Updated 15 October 2026

IronStorage does not operate a password-storage service. The developer receives no passwords, keys, analytics, advertising identifiers, app inventory or crash reports from the app. There are no advertising or analytics SDKs.

On your device
Your password-store repository, settings, imported/generated GPG key material and the TOTP discovery cache remain in the app's private, backup-excluded storage. Password entries use the upstream pass GPG format. The discovery cache records entry paths and ciphertext fingerprints so that unchanged entries can be found while locked; it does not store passwords or OTP seeds in plaintext. Passphrase-protected private GPG keys require their passphrase. Optional saved passphrases and HTTPS credentials are encrypted using Android Keystore keys. Biometric templates remain with Android; IronStorage receives only the authentication result and authorized cryptographic operation.

Optional network access
Local-first use needs no server or IronStorage account. When you configure HTTPS Git synchronization, IronStorage contacts your selected Git server. The server receives the encrypted Git repository plus its unencrypted Git metadata (including entry paths and configured commit name/email), network address and the authentication credentials needed by that server. The server administrator controls retention and access. The developer receives none of this traffic unless you independently choose a server operated by the developer. TLS protects the connection; GPG protects entry contents for their configured recipients. Git metadata and HTTPS authentication are not end-to-end encrypted by GPG.

Camera and QR transfer
Camera permission is requested only when you choose Scan QR. Frames are processed on the device and are not retained or uploaded. QR export can contain private keys when you explicitly select that option and confirm the warning. Anyone who photographs the displayed code may obtain its contents. Import/export does not send QR payloads to the developer.

Autofill, Credential Manager and clipboard
Provider use is optional and must be enabled in Android settings. IronStorage verifies the requesting app's package identity and signing certificate locally. Broad package visibility supports this verification; it is not used to inventory apps, advertise or track you. Selected credentials are returned only through the Android provider request after the app's confirmation/authentication flow. Copy actions place the chosen value on the system clipboard; other apps or keyboards may have access under Android's rules. IronStorage marks sensitive clipboard content and schedules clearing it.

Deletion, uninstall and backup
Android cloud backup and device-transfer backup are disabled for IronStorage. Uninstalling or clearing app storage removes the local repository, keys, settings and cache and makes the app's Keystore-protected records unavailable. Reinstalling does not restore them. Preserve an independent compatible password-store repository and the GPG private keys/passphrases you need before uninstalling. Data already pushed to a Git server remains there until removed under that server's policy. Removing a local entry does not rewrite older Git history. No developer-side account or deletion request is needed because IronStorage creates no such account or database.

Support
https://git.rfc1437.de/hugo/IronStorage/issues
Support submissions are voluntary and public. Do not include passwords, tokens, private keys, private repository URLs or identifying diagnostics. Linked websites and your configured Git host have their own privacy policies.
