Privacy Policy

Last updated: October 7, 2026

KeyCodeNav (also called KeyCodeNavigator) is an iPhone and iPad app published by Vizsla Tech LLC ("we," "us"). It stores access codes for places and shows you the right one when you arrive. It can also share a place with people you choose. This policy explains what the app does with your information.

The short version

• Your places, codes, notes, contacts and documents are stored on your device. Codes, notes and documents are encrypted there. The app is designed so that we can't read any of them.
• There's no sign-up and no account on a server.
• There's no advertising, no analytics and no tracking.
• When you share a place, the message you send holds only an invite link, never a code. What you share is encrypted on your phone before it leaves. It goes through our relay, which is designed to keep it only until the other person's phone has it, typically within minutes.
• To deliver shared places, our relay keeps a few things it can read: random identifiers, dates, and the Apple push token of each phone that receives a share. It's designed so that it can't read a code, a name, an address or a document.
• Address search sends what you type, and your location while you search, to Google. Typed-address and map-pin lookups go to Apple.
• All of this is described below.

Information stored on your device

Everything you enter is kept in the app's storage on your device:

• place names and addresses, and map pins;
• access codes and notes;
• contact names and phone numbers;
• documents;
• the name you give for sharing ("Your name");
• your settings.

The app encrypts access codes, notes and documents with a key kept in your device's Keychain. If you chose a password to unlock the app, only a secure hash of it is stored, in the Keychain. If you unlock with Face ID, Touch ID or your passcode, iOS does the check, and the app stores nothing for it. We never have access to any of it.

Places that someone shares with you are stored on your device in the same way.

To work, the app also keeps a few things on your device:

• your subscription status as Apple last reported it, so the app works offline;
• when it last alerted you at each place;
• its latest position, to choose which places to watch;
• the gate spot you set for a place, if you drop a pin for its gate (it isn't shared with anyone you share the place with).

None of these is sent to us. They're deleted with the place, or by Delete account and all data.

Documents. You can add documents to a place: a cost sheet, a floor plan, a photo of a flyer. They can come from the Files app, from Photos, from the camera's document scanner, or from what you copied (only when you tap Paste). The app keeps them encrypted in its own storage on your device. When you open one, it decrypts a temporary copy and deletes that copy when you close it. A document leaves your device only when you share it with someone (see "Sharing a place"). Documents are deleted when you remove them, when you delete the place, and by Delete account and all data.

Like other app data, this information may be included in your device's iCloud or computer backups if you have backups turned on. Those backups are handled by Apple or your computer, not by us.

Location

The app uses your location only if you have a plan or the free trial, and only if you allow it. It is never asked for location if you only receive places that others share.

With your permission, KeyCodeNav uses your location, including in the background, to:

• notice when you arrive at one of your places and show you its details;
• show a place's gate code when you stop at its gate;
• show distances and the Nearby list;
• show the Nearest place widget.

All of this is worked out on your device, and your location is never sent to us. While you search for an address, your location is sent to Google so that nearby addresses come first (see "Address search").

If your plan or the free trial ends, the app stops using your location the next time you open it. Until you do, iOS can still wake the app in the background as before, when you come near or leave a place it was watching or after you've moved some distance, and the app can use your location then, on your device.

Address search (Google)

When you type in the address search box, the app sends only these to Google Places to suggest matching addresses:

• the text you type in the address search box;
• your current location while you search, so nearby addresses are suggested first.

Google acts as our service provider for address search: it processes your search only to return matching addresses, under Google's terms and the Google Privacy Policy. This information is not linked to your identity and is not used for tracking. We don't sell or share it. We use only Google Maps Platform's Places service, and no Google advertising products. Your access codes, notes and contacts are never sent.

Address lookup (Apple)

When you enter an address by hand and find it on the map, or drop a pin and the app fills in its address, the lookup is done by Apple's geocoder (MapKit), not Google. Apple receives the address you entered or the pin's map position, under Apple's Privacy Policy. Your access codes, notes and contacts are never sent.

Maps

Maps in the app are displayed with Apple Maps, which is subject to Apple's Privacy Policy.

Notifications

The app creates every notification on your device:

• arrival alerts;
• the gate alert when you stop at a place's gate;
• "The code was updated" for places shared with you;
• the free-trial reminder, two days before your free trial ends;
• renewal notices for your plan.

By default, a notification shows only the place's name. Codes appear in notifications only if you turn on Show codes in notifications in Settings. The same goes for the lock-screen arrival card, which is off by default.

Push notifications

When someone shares a place with you, your phone gives our relay its Apple push token. The relay uses it to wake the app when something new is waiting for you. Only phones that receive a share send one.

The wake-ups are empty. They carry no text and no code, and nothing appears on screen. The app then fetches the update itself. Wake-ups travel through Apple's Push Notification service, which receives the token and the time of each wake-up under Apple's Privacy Policy.

The relay stores each token encrypted under a key that only its own functions hold. It keeps a token while it shares with that phone. It deletes the token when you stop following the place, or when Apple reports the token is no longer valid. Otherwise the token goes as described under "How long it's kept". Through this token, the relay can tell that several shares go to the same phone.

The app works without the wake-ups. It also checks for updates when you open it, in the background, and when you arrive near a shared place.

Sharing a place

What the message holds. You choose a person and exactly which codes and documents they get. The app makes one invite link for that person, then opens Mail or Messages with it. The message holds only the link and a line about the app. It never holds a code, a document, the place's name or its address. Nothing is sent until you tap Send. The message then goes like any other email or text. Your email provider, and any link scanner it uses, keeps the link like the rest of the message.

Encryption. Sharing is designed to be end to end: the app encrypts the place on your phone before anything leaves it, and our relay only passes it along, without the keys to read it.

• Until the other person adds the place, it's encrypted with a key that exists only in the link, after the "#". Web browsers never send that part to a server, so neither our relay nor our website receives it.
• Once they've added the place, the two phones agree on a new key that our relay never sees. Every later change is encrypted with it.
• One exception: you might stop sharing and let them keep their copy before your phone has checked in since they added it. In that case, the changes they hadn't received go with that last message, encrypted with the link's key.

Before the invite is added. Anyone who has the link can see, in the app:

• the place's name, address, map pin and contact (name and phone);
• your name, if you gave one;
• how many codes and documents are waiting.

They never see the codes or documents themselves. The first phone that adds the link receives the codes and documents, and then the link works for no other phone. That's why the message asks people not to forward it. Our website never shows any of this: it only offers to open or get the app. An invite nobody adds is deleted after 7 days.

Your name. If you enter "Your name", it travels encrypted with the place, and the people you share with see it.

Documents.

• Shared documents are encrypted on your phone. They're compressed first when that makes them smaller.
• They're uploaded to our relay's file storage, and the other phone downloads them, each time through a short-lived link.
• Every photo you share goes without its location, camera and capture details: where and when it was taken, and the camera or phone, its settings and serial numbers. It keeps only what's needed to show it, such as its size, orientation and colours. Photos larger than 2560 pixels are also resized into a JPEG.
• If you turn on Send photos at original quality, your photos are sent untouched, with whatever information they hold, such as where they were taken.
• PDFs and other files are sent unchanged.
• The relay is designed so that it can't read any of them.

Updates and removing someone.

• When you change a code, a detail or a document, your phone sends the encrypted change, and their phone fetches it.
• You can pause their updates (their copy stays as it is and says "No longer updated"), resume them, or remove them.
• Removing someone is designed to delete their copy the next time their app connects, and the app is designed never to encrypt a new code for someone you removed.
• Deleting a shared place also removes it from their phones, unless you choose to let them keep a copy.
• People you share with can't share the place on.

Removing someone can't take back what they already saw: a code they wrote down or a screenshot stays with them. To lock someone out, change the code itself. The app is designed so that a new code is never encrypted for a person you removed.

Calling or texting a place's contact opens your Phone or Messages app with their number. Nothing else is passed along.

The clipboard

• On our website's invite page, the Get button copies your invite link to your clipboard, so the app can add it. Like anything you copy, Universal Clipboard may briefly offer it to your other Apple devices signed in to the same Apple Account.
• The app reads the clipboard only when you tap Paste, in one of two places:
  • iOS's Paste button on the "I received an invite" screen. Only the invite link is used. Once the app has kept it, the app clears it from the clipboard, unless you've copied something else since.
  • Paste in a place's Add document menu. This adds what you copied as a document.
• On its first screen, the app asks iOS whether the clipboard seems to hold a web link, without reading it, so it can say "Your invite looks ready to paste."
• Copy on a code puts the code on your clipboard. Delete account and all data clears the clipboard if it still holds a code the app copied.

What our relay keeps

Our relay is a service we run on our hosting provider. It has no accounts, and it stores only what delivery needs:

• Content until it's delivered: encrypted items until the receiving phone confirms it has them. After that, only a record with no content (an id, a version and sequence numbers).
• Records with no code, kept longer (see "How long it's kept"): whether a share is active or paused, removal markers, and the final removal or end notice.
• Hashes, never the secrets themselves: SHA-256 hashes of the random tokens the phones use, of proofs derived from the link, of document file tokens and of document claim tickets. Never the tokens, the link's secret or any key.
• Keys and tags: the receiving phone's public key, and a tag that ties it to the link. Also, per share, a random device tag (the current one and up to 8 earlier ones). Device tags can't link one phone's shares to each other.
• Push tokens: the encrypted push tokens of receiving phones (see "Push notifications").
• Documents: encrypted document files, for at most 30 days, with their sizes, upload times and how many download links were issued for them.
• Re-send requests: open requests from a restored phone to send something again (item ids only).
• Upload counts: per share, how many documents and bytes were uploaded today and yesterday.
• Counters and dates: version and sequence numbers, and dates.
• Push timing: only while an update waits, and for 20 minutes after a wake-up.

The relay is designed never to receive a readable code, name, address, contact or document, or any key that could decrypt them.

What it can link. Through push tokens, the relay can link the shares one phone receives. Its request logs (below) could show which phones exchange a share.

What it can't do. The encryption is designed so that the relay can't read, change or forge a code, a document or a removal notice, or put another phone in place of the one that added the share. Like any delivery service, it could delay, withhold or delete what it holds.

Request logs and backups

For each call the app makes to our relay, our hosting provider's request logs record:

• the IP address, and the approximate location worked out from it;
• the app and iOS version;
• the address called, including the short-lived links used for documents;
• the time.

The logs are kept for up to 7 days. They could show which phones exchange a share. Database backups are kept for up to 7 days, and document files aren't in them.

How long it's kept

Encrypted shared data (codes, place details and documents) is designed to be kept on our relay only until the receiving phone has it, typically within minutes. If either phone stops checking in, the share is deleted 180 days after its last check-in; document files are deleted after at most 30 days. When you remove someone, their shared data is deleted at once; only a notice with no codes waits for their phone (until it confirms, plus 30 days; at most about 430 days). If you let them keep a copy, anything not yet delivered waits for their phone for at most 180 days, and a notice with no codes waits until their phone confirms it, plus 30 days (at most about 210 days). An invite nobody accepts, with its place preview (no codes or documents), is deleted after 7 days. The relay also keeps each receiving phone's Apple push token while it shares with that phone. Our host keeps deleted data in backups for up to 7 days and request logs for up to 7 days.

These periods are how the relay is designed to work. It deletes expired data on a regular schedule, so an item can remain for a short time after its period ends.

Purchases and subscriptions

Plans (Monthly or Annual, each with Apple's free trial for new subscribers) are bought through Apple, and Apple handles payment. We receive no payment details. The app asks Apple (StoreKit) for your subscription's status and keeps that status on your device, so the app works offline. Nothing about your purchases reaches our relay. The trial reminder and renewal notices are scheduled on your device.

Contacting us

If you email us from Help & Support, your mail app opens a message with a short block of technical details:

• the app and iOS version, and the device model;
• the Location permission, and whether Precise Location is on;
• whether notifications are allowed, with the Time Sensitive and preview settings;
• whether Background App Refresh and Low Power Mode are on;
• whether arrival alerts are on;
• the number of saved places and the alert distance;
• GPS use: the minutes per day the app used each level of location accuracy, as iOS reports it (MetricKit);
• crashes in the last 14 days: the date, the app and iOS version, the kind of crash and where in the app it happened;
• the arrival log: the latest 50 times the app woke near your places, whether it used GPS and why, but never which place, where you were or a code.

The GPS use, crash and arrival records are kept only on your device, and Delete account and all data deletes them. The details never include codes, addresses or names, and you can edit or remove them before sending. We use support emails only to answer you, and delete them when they are no longer needed.

If you choose to share crash reports with app developers in iOS Settings, Apple may pass anonymous crash reports to us. We use them only to fix problems.

Service providers

We use these providers to run the app:

• Supabase, Inc. hosts our relay and its file storage in the United States (US East 1, Northern Virginia).
• Apple delivers the push wake-ups and handles purchases, maps and address lookups.
• Google provides address search.
• Vercel Inc. hosts keycodenavigator.app.

Our website

keycodenavigator.app uses no cookies, no analytics and no ads. Its host keeps standard request logs (IP address, page and time) for 1 day. The invite page:

• never receives the part of an invite link after "#";
• never fetches the share;
• never shows a code or a document;
• loads no third-party code.

Deleting your information

In the app, Settings → Delete account and all data… is the last item in Settings, with or without a plan. After you confirm, and confirm it's you with Face ID, Touch ID, your passcode or your app password, it does three things.

1. It closes your shares. Removals for the places you share are prepared first, and the keys that could encrypt anything new for those people are deleted, so the app is designed never to encrypt anything new for them. Copies you let someone keep stay with them. It stops following the places shared with you.
2. It sends the removals and departures to our relay. Without a connection, they go the next time the app can connect, and the app says so. Keep the app installed until then.
3. It deletes from your device:
   • every place, code, note, contact, document and gate pin;
   • the name you give for sharing;
   • the way you unlock the app, and the encryption key;
   • its record of your subscription status.
   It also resets your settings.

What it keeps:

• a random device marker that never leaves your phone and identifies no one;
• your choices about plan reminders, and its record of which plan messages it has already shown;
• whatever it still has to send (removals and departures, never a key).

Apple keeps your subscription and your trial eligibility. Deleting doesn't cancel a subscription: cancel it in Settings → your name → Subscriptions.

On our relay afterwards:

• A removed share's content is deleted as soon as the removal arrives. Only a notice with no codes waits for the other phone (until it confirms, plus 30 days; at most about 430 days).
• A copy you let someone keep waits until their phone has it (at most 180 days).
• For places shared with you, the content and your push token are deleted once your departure arrives.
• Document files go when they're withdrawn, or 30 days after upload.
• Backups and request logs are kept for up to 7 days.

If you delete the app instead, its places and codes go from your phone. But the places you shared stay on the other people's phones with the codes they have, so change those codes. Shares on our relay then end as described under "How long it's kept" (180 days after the last check-in). Until then, a share you received keeps your phone's push token, until Apple reports it invalid.

Apart from what's described above, we hold none of your data, so there's nothing else for us to delete. Earlier iCloud or computer backups of your phone are yours to delete.

Your privacy rights

The sections below explain your rights under California, European and UK law. They describe the same practices as the rest of this policy: there's no account, the app keeps your places on your device, what you share is encrypted on your phone so our relay can't read it, and what the relay holds is deleted on the schedule under "How long it's kept".

What we can find. Because there's no account, our relay's records are tied to random identifiers, not to your name or email address. We usually can't tell which records are yours, and we won't ask for more information just to find out. The quickest way to act on your information is in the app: Delete account and all data deletes it from your device and closes your shares on our relay. For anything else, email info@vizslatech.app.

California (CCPA)

This section is for California residents, under the California Consumer Privacy Act as amended by the California Privacy Rights Act. We're below the thresholds that make that law apply, so we aren't currently required to comply with it, but we choose to honour these rights for everyone anyway.

What we collect, and why. In the last 12 months we have collected these categories of personal information:

• Identifiers: the IP address in our relay's and our website's request logs, the encrypted push token of a phone that receives a share, the random identifiers and device tags the relay uses, and your email address if you email us. Used to deliver shared places, to keep the relay and website running and secure, and to answer you.
• Internet or network activity: what each request to our relay or website was, its time, and the app and iOS version. Used to run the service and fix problems.
• Approximate location: worked out by our hosting provider from an IP address in the relay's request logs. It's not your precise location, which the app never sends to us.
• What you send us: the content of support emails, including the technical details you choose to include (see "Contacting us"). Used only to answer you.

What you share with other people (codes, place details, contacts, documents and your name for sharing) passes through our relay encrypted, in a way designed so that we can't read it. We collect these categories from your device, your browser and you. We give them only to the providers that run the service for us (see "Service providers"). Google receives address searches as our service provider, only to return matching results (see "Address search"). We don't collect sensitive personal information as the law defines it.

We don't sell or share your personal information. We don't sell personal information, and we don't share it for cross-context behavioural advertising. We haven't done either in the last 12 months. We have no advertising, analytics or tracking.

Your rights. You have the right to:

• know what personal information we've collected about you, where it came from, why, and who we gave it to;
• have it deleted;
• have it corrected if it's wrong;
• opt out of its sale or sharing (we do neither, so there's nothing to switch off, but you can still ask);
• not be treated differently for using any of these rights.

How to use them. In the app, Delete account and all data deletes what the app holds and closes your shares on our relay. Your places, codes and contacts are on your device, so you can view and correct them in the app at any time. For any other request, email info@vizslatech.app. You can also have someone you authorise make a request for you. We answer within 45 days, and we may need to check the request is genuine first. See "What we can find" above for the limits.

How long we keep it. As set out under "How long it's kept": relay request logs and backups up to 7 days, website request logs 1 day, shared data only until it's delivered (with the limits in that table), and support emails until they're no longer needed to answer you.

Global Privacy Control. If your browser sends a Global Privacy Control or similar opt-out signal, we treat it as a request to opt out of the sale and sharing of your personal information. As we don't sell or share it, nothing else changes.

Europe (GDPR)

This section is for people in the European Economic Area, under the General Data Protection Regulation.

Who is responsible. The controller of your personal data is Vizsla Tech LLC. Contact us at info@vizslatech.app.

What we process, why, and on what basis:

• Delivering what you share (the encrypted items, random identifiers, device tags, push tokens, dates and counts on our relay): to provide the sharing you ask the app for. Basis: performing our agreement with you.
• Request logs and backups (IP address, approximate location, app and iOS version, the request and its time): to keep the relay and website running and secure and to fix problems. Basis: our legitimate interest in a working, secure service.
• Support emails and the technical details you choose to send: to answer you. Basis: our legitimate interest in answering, or our agreement with you when it's about your plan.
• Crash reports from Apple, only if you allow sharing with app developers in iOS Settings: to fix problems. Basis: your consent, which you can withdraw in iOS Settings at any time.

Your location, places and codes are processed only on your device, and we never receive them in a form we can read.

Your rights. You have the right to:

• access your personal data;
• have it corrected (rectification);
• have it deleted (erasure);
• have its processing restricted;
• receive it in a portable format (portability);
• object to processing based on our legitimate interests;
• withdraw your consent at any time, without affecting what was done before.

Use them as described under "How to use them" above: in the app, or by email. We answer within one month. The app has no export of your places; they stay on your device, where you can see them all. See "What we can find" above for what we can match to you.

Complaints. You can complain to the data protection supervisory authority in the country where you live or work, or where you think the law was broken. We'd appreciate the chance to sort it out first, at info@vizslatech.app.

How long we keep it. As set out under "How long it's kept" and in the California section above.

Where it's processed. We're based in the United States, and our relay and website are hosted there (see "Service providers"). The United States may not protect personal data the way your country does. Transfers from the European Economic Area and Switzerland are covered by the EU Standard Contractual Clauses in each provider's Data Processing Addendum. We also limit what goes there: what you share is encrypted on your phone, designed so that it can't be read in transit or on our relay, and the rest is kept only briefly.

United Kingdom

This section is for people in the UK, under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Everything in the Europe section applies in the same way: the controller (Vizsla Tech LLC), what we process and why, the bases, your rights, how long we keep it, and processing in the United States. Transfers from the UK are covered by the UK International Data Transfer Addendum to those Standard Contractual Clauses.

Complaining to us. You have the right to complain to us directly about how we use your personal data. Email info@vizslatech.app with "Privacy complaint" in the subject, and tell us what happened. We'll acknowledge it within 30 days, look into it without undue delay, and tell you the outcome.

Complaining to the ICO. You can also complain to the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Children

KeyCodeNav is not directed to children under 13, and we do not knowingly collect information from children.

Changes to this policy

If this policy changes, we will update it here and change the "Last updated" date above. Significant changes will also be noted in the app's release notes.

Contact

Vizsla Tech LLC
info@vizslatech.app