MoatKey Get MoatKey
SharingSecurityPlansHelpFor business
MoatKey · Legal

MoatKey Privacy Policy

Effective October 1, 2026. Updated October 23, 2026: the optional breach check (section 6A). Updated October 8, 2026: the iPhone and iPad app; optional filling of payment cards (section 6) and AutoFill on phones (section 7); comments and requests in shared Castles and promo codes (section 4).

MoatKey is a password manager made by G3NO SYSTEMS LLC ("G3NO SYSTEMS", "we", "us"). This policy explains what we collect, what we cannot see, and what you can do about it. It covers the MoatKey browser extension for Google Chrome and Microsoft Edge, the MoatKey Android app (package com.g3nosystems.moatkey) and the MoatKey iPhone and iPad app. There is no web vault. Our website is covered by the separate G3NO SYSTEMS Privacy Policy.

1. The short version

  • Your master password never leaves your device. We never receive it.
  • Your passwords, usernames, website addresses, notes, payment cards, authenticator codes, and the comments and requests you write in shared Castles are encrypted on your device before they are sent to us. We store only the encrypted form, and we cannot read it.
  • We do store some things we can read: your email address, your Castle names and members, plan details and basic facts about your records (such as when they changed). Section 4 lists all of it.
  • We don't sell your data, show ads or use your data to train AI. MoatKey has no analytics or advertising SDKs. The one exception to know about is Google's on-device barcode scanner in the Android app (section 8).
  • If you forget your master password and lose your recovery kit, we cannot get your data back.

2. How the encryption works

  • When you create an account, your device turns your master password into an account key with Argon2id. This happens on your device.
  • The account key locks (wraps) your vault key. We store only the locked version.
  • Each record is encrypted on your device with XChaCha20-Poly1305 before upload.
  • Castles are shared vaults. Each Castle has its own key, sealed separately for each member with a hybrid of X25519 and ML-KEM-768. We store the sealed copies and never hold a Castle key in a form that can open your data.
  • When a Castle's key changes (for example after someone is removed), the owner signs the change with ML-DSA-65, and members' apps refuse a key change the owner didn't sign.
  • Safety numbers let members check they have the right key for each other. Your device remembers the numbers it has seen, on your device.

No software is perfect. Our Security page describes the current state of security review.

3. Data we cannot read

We never receive these, or only ever receive them encrypted:

  • your master password;
  • your saved passwords, usernames and website addresses;
  • secure notes and account-info contents;
  • payment cards you save (card number, name on card, expiry and security code);
  • the text of comments on items and of requests (and replies) in shared Castles;
  • authenticator (two-factor) secrets;
  • your vault key and Castle keys in usable form;
  • your private sharing keys (we store them only encrypted).

Passkeys you save in MoatKey (Beta, browser extension) are end-to-end encrypted like your other items: we store only the encrypted form and cannot read it.

4. Data we store and can read

Our servers run on Supabase (database, sign-in and server functions), hosted in the United States. We store:

Account. Your email address; a hash of a sign-in secret that your device derives from your master password with a separate one-way step (it cannot unlock your vault); and an optional display name.

Encryption envelopes. Your encrypted account-key envelope (ciphertext, salt and key-derivation settings), your public sharing keys (others use them to share with you), and your private sharing keys, encrypted.

Castles. Castle names are not encrypted, so please don't put secrets in a Castle name. We also store whether a Castle is personal or shared and what it's for (personal, family or business), who the members are and their roles, the sealed copies of the Castle key, and the owner-signed log of key changes.

Records. The encrypted record, plus a few facts about it that are not encrypted: its broad type (a login, or another item; secure notes, Wi-Fi networks, door codes and payment cards all look the same to us), when it was created, updated or deleted, which account created or last updated it, whether it is in the Dungeon, and a revision number.

Comments and requests (shared Castles, from version 0.7). The encrypted text, plus which Castle and item it belongs to, which account wrote it, when, and for requests whether it is open, done, declined or canceled and who resolved it.

Promo codes. If you redeem a promo code, a one-way hash of the code (never the code itself), the plan it gave you and when. Codes are created and managed by G3NO SYSTEMS staff; their actions are kept in an internal log.

Activity log. Events such as "record created" or "member added", with the time and the account that did it. They never include item titles or secrets.

Invitations. The invited person's email address, the role offered, the status and when the invitation expires.

Legacy (emergency access). If you turn on Legacy, we store the email address of the contact you name, the waiting period you chose, the status of the request and the times that matter (when it was asked for, denied or granted). We email you and your contact about it: you, when your contact asks for access, about halfway through the waiting period, 24 hours before it ends and when access is granted; your contact, a receipt when they ask. These emails are sent by Resend (section 12). They never include any secret. Castle contents stay encrypted and are not readable by us in Legacy either.

Subscription. Your plan, its status, the number of seats and the end of the current billing period. For plans bought in the browser, the Stripe customer and subscription IDs that link your account to Stripe. For plans bought on Android, the Google Play product and plan, the subscription state, and a one-way hash of the purchase token (never the token itself).

Technical logs. Our hosting providers keep standard server logs (such as IP address, time and request type) for security and operations, for a limited time.

5. Data kept on your device

  • Encrypted session tokens, so you stay signed in.
  • A device-only memory of other members' safety numbers.
  • Optional quick-unlock material if you turn it on: in the browser extension, a passkey (for example Windows Hello); on your phone, the phone's secure keystore with your fingerprint, face or screen lock. Your biometric data stays with your device's operating system; we never receive it.
  • If you turn on AutoFill on your phone (section 7), an encrypted list of the logins (and, if you also turn on "Fill payment cards", the cards) it may fill. It is kept only on the phone, its key is held by the phone's secure hardware, and it can be opened only after your fingerprint, face or screen lock.

6. How the browser extension reads web pages

The extension reads a web page only when you ask it to save that page's login, from the right-click menu or with the Alt+Shift+S shortcut. It uses the browser's "activeTab" permission for this and has no standing access to the sites you visit. What it reads (username, password and page address) is encrypted on your device before upload.

Offer to save logins (optional, from version 0.7). If you turn on "Offer to save logins", you allow the MoatKey extension to read secure (https) web pages you visit. MoatKey looks at a page only at the moment you submit a sign-in form there: it reads the username and password you just entered and offers to save them. That login stays in your browser's memory for at most three minutes and is deleted when you save it, dismiss the offer or close the browser. Nothing is sent to us unless you press Save, and saved logins are encrypted on your device before they leave it, so we cannot read them. You can turn this off at any time in Settings, Saving logins, which also gives the website access back to your browser. The list of sites you chose "Never for this site" for is kept only on your device. This setting is off unless you turn it on.

Filling payment cards (optional, from version 0.9). If you turn on "Fill payment cards" (Settings, Saving and filling), the MoatKey button shows your saved cards on secure (https) checkout pages. Nothing is filled until you choose a card and confirm the page. MoatKey then writes the card number, expiry and name into that page; the security code is filled only in a separate step after you enter your master password or confirm with Windows Hello or another passkey. Many shops show card fields inside a payment company's frame (for example Stripe, Braintree, Adyen, Shopify, Square or PayPal); turning the setting on asks your browser to let MoatKey fill those frames too, and turning it off gives that access back. MoatKey never fills cards on insecure (http) pages or into frames from unrelated sites. The card values go only into the page you confirmed; we don't receive them. When you then pay, the shop and its payment company receive your card details exactly as if you had typed them, under their own privacy policies. This setting is off unless you turn it on.

Which servers the extension talks to. The browser extension connects to MoatKey's server, and to nothing else, with one exception: if you turn on the optional breach check (section 6A), it also connects to api.pwnedpasswords.com.

6A. Optional breach check (off by default)

MoatKey can check whether a password you saved appears in a public list of leaked passwords. It is off until you turn it on in Password health, in the browser extension or the phone app. When it is on, it runs when you press "Check now" and at most once a day while MoatKey is unlocked.

How it works: your device makes a one-way fingerprint (a SHA-1 hash) of each saved login password and sends only the first 5 characters of that fingerprint to the Pwned Passwords service run by Troy Hunt (Have I Been Pwned), at api.pwnedpasswords.com. That is not enough to identify your password, and the service returns many possible matches. Your device then compares the rest of each match against the full fingerprint, locally. The service never receives your passwords, the full fingerprint, your usernames, website addresses, item names or your MoatKey account. MoatKey's own servers are not involved and see nothing about the check. Requests ask the service to pad its replies so their size does not hint at which password you checked, and they are sent without cookies or a referrer. As with any web request, the service sees your device's IP address.

MoatKey keeps only a "found in a breach" yes or no and a count for each item, in memory while the app is unlocked. It never saves a password fingerprint. The on/off setting and the time of the last check are kept on your device. Password health itself (weak, reused, old and missing two-step sign-in) runs entirely on your device and sends nothing anywhere. Items in the Dungeon are not checked.

7. AutoFill on Android, iPhone and iPad (optional)

If you turn on AutoFill in MoatKey's settings and choose MoatKey as your phone's AutoFill service, MoatKey can fill your saved logins into other apps and browsers. If you also turn on "Fill payment cards", it can fill your saved cards: on Android in apps and in Chrome (with Chrome's "Autofill using another service" setting), and on iPhone and iPad from the AutoFill menu when you touch and hold a field. Every fill needs your fingerprint, face or screen lock first, and shows where it will fill. To fill, your phone's operating system tells MoatKey which app or website is asking and which kinds of fields it shows; MoatKey uses that only on your phone to pick matching logins or cards and does not send it to us. The encrypted list MoatKey fills from is described in section 5; it is deleted when you turn AutoFill off, sign out or delete your account.

8. Camera and QR scanning in the Android app

When you scan a two-factor setup QR code, the Android app uses your camera and Google's ML Kit barcode scanner. The code is read on your phone. Google's ML Kit library may send Google diagnostic and usage information about the scanner (for example device type, app version and performance), under Google's own terms. We don't receive the camera image. You can always type the setup key instead of scanning.

9. Payments

In the browser extension, payments are processed by Stripe. When you upgrade or manage billing, a Stripe page opens in a new tab. Stripe receives your email address, billing details and payment method. We never see or store your full card number. See Stripe's privacy policy.

In the Android app, subscriptions are sold and billed by Google Play. Google handles your payment details under its own privacy policy. To link the purchase to your MoatKey account, the app passes your MoatKey account ID to Google Play, and we check the purchase with Google.

In the iPhone and iPad app, there is nothing to buy. A plan bought on another platform is shown, and its features work, on iPhone and iPad too.

From any of these, we receive only what we need to run your plan (see "Subscription" in section 4).

10. Why we use your data

  • to create and run your account;
  • to sync your encrypted vault between your devices;
  • to let you share Castles with people you invite, and to deliver their comments and requests;
  • to fill your logins and payment cards when you ask (on your device only);
  • to send account emails, such as sign-in emails and Castle invitations;
  • to process your subscription;
  • to keep the service secure and prevent abuse;
  • to meet legal obligations.

Legal bases (EU/UK users): performing our contract with you (running the service), our legitimate interests (security and abuse prevention), and legal obligations (for example tax records).

11. What we don't do

  • We don't sell or rent your personal data.
  • We don't share your data for advertising.
  • We don't add analytics, advertising or tracking SDKs (see section 8 for Google's scanner library).
  • We don't use your data to train AI models.

12. Who we share data with

We use a small number of service providers that handle data on our behalf:

  • Supabase (database, sign-in, server functions; US): everything in section 4.
  • Stripe (browser payments): billing details, payment method, email address.
  • Google Play (Android payments): your purchase and your MoatKey account ID, as described in section 9.
  • Resend (sign-in and invitation emails): the recipient's email address and the email content. Invitation emails include the inviter's name and the Castle name, never any secret.
  • Google ML Kit (Android QR scanning): scanner diagnostics, as described in section 8.
  • Pwned Passwords (Have I Been Pwned), only if you turn on the optional breach check: the first 5 characters of a password fingerprint, and your device's IP address. Never a password. See section 6A.

We may also disclose data if the law requires it, for example a valid court order. Even then, we can only hand over what we have: your vault contents are encrypted and we cannot decrypt them. If the company is sold or merged, your data may transfer to the new owner under this policy, and we will tell you first.

13. How long we keep data

  • While your account is open, we keep your data so the service works.
  • When you delete your account, we delete your account, your encrypted vault data, your keys and your Castle memberships. Database backups are overwritten on their normal schedule. Details are on the Delete your account page.
  • Shared Castles: items you saved in a Castle someone else owns stay there for its other members, without your name attached.
  • Billing records: Stripe, Google and we may keep billing records as long as the law requires (for example for tax).

14. Your choices and rights

  • Export your vault. After re-entering your master password you can save one backup file with everything you can open. It is encrypted on your device with a backup passphrase you choose; we never receive the file or the passphrase. The browser extension can also save an unencrypted CSV for moving to another password manager, after a warning; delete that file once imported.
  • Cancel your subscription at any time: in the browser through the Stripe billing page, or on Android in Google Play.
  • Turn off "Offer to save logins", "Fill payment cards" and phone AutoFill at any time in Settings.
  • Ask for a copy of the personal data we hold about you, or ask us to correct it.
  • Delete your account in the app or by email. See Delete your MoatKey account.

Depending on where you live (for example the EU, UK or California), you may have more rights, such as objecting to processing or complaining to a data protection authority. We do not sell or share personal information as those terms are defined under California law. To make a request, email support@moatkey.com from the address on your account.

15. Children

MoatKey is not for children under 13. If you are under 18, you need a parent's or guardian's permission to use it. If we learn that a child under 13 has an account, we will delete it.

16. Where data is processed

G3NO SYSTEMS is based in South Carolina, USA, and MoatKey's data is stored in the United States. If you live elsewhere, your data is processed outside your country.

17. Security

We designed MoatKey so that we cannot read your vault, and we use access controls on our database. No system is perfectly secure. MoatKey has had internal review only; an independent security review has not happened yet. To report a problem, see our Security page.

18. Changes to this policy

If we change this policy, we will update the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.

19. Contact

G3NO SYSTEMS, LLC
777 Lowndes Hill Rd, Bldg 2, Ste 300 #213
Greenville, SC 29607
support@moatkey.com