Privacy & Terms of Service

02The core principle: we don't hold your data

• Your vault is a standard encrypted KeePass file. It is encrypted and decrypted locally on your device using your master password and/or key file.
• Your master password and key file never leave your device and are never transmitted to us.
• We do not operate accounts, we do not require registration, and we have no servers that receive, store, or process your passwords, entries, notes, attachments, or any other vault contents.
• Because we never receive your data, we cannot read it, share it, sell it, hand it over in response to a legal request, or recover it for you.

03Where your data is stored — your choice

Airtight does not provide storage. You choose where your vault file lives. Options may include:

• Local storage on your device
• A third-party cloud or sync provider of your choosing (for example iCloud Drive, Dropbox, Google Drive, OneDrive, or a WebDAV server)

When you store or sync your vault through a third-party provider:

• Your use of that provider is governed by that provider's own terms and privacy policy, not ours.
• The file handed to the provider remains encrypted in the KeePass format. The provider stores an encrypted blob; the keys to it stay with you.
• We are not responsible for the availability, security, pricing, or conduct of any third-party storage provider. Choosing, configuring, and trusting that provider is your decision.

04Optional connections to third-party services

Airtight can connect to certain outside services to add convenience features. Every one of these is off by default, opt-in, and limited to a clearly stated purpose. You can enable or disable each one at any time in settings, and the app functions fully as a password manager without any of them.

When a feature is enabled, only the minimum information needed for that specific feature is sent, and it is sent directly from your device to the relevant service — it does not pass through us.

4.1 — Website icons (favicons)

If you enable icon fetching, Airtight can retrieve a website's icon to display alongside an entry. To do this it requests the icon from DuckDuckGo. This may reveal to that host that a request for a given domain's icon was made from your IP address. No vault contents, usernames, or passwords are sent.

4.2 — Breach checking (Have I Been Pwned)

If you enable breach checking, Airtight can check whether a password or email address appears in known data breaches using the Have I Been Pwned (HIBP) service.

• For password checks, Airtight uses HIBP's k-anonymity model: your password is hashed locally on your device, and only the first five characters of that hash are sent. Your actual password — and the full hash — never leave your device, and HIBP cannot determine which password you checked.
• For email checks (if offered), the email address you ask about is sent to HIBP to look up breach records. Only the specific address you choose to check is sent.
• Your use of HIBP is also subject to HIBP's own terms and privacy policy.

05What we collect

In normal use, Airtight collects no personal data and sends us nothing.

• We do not require an account.
• We do not include advertising or third-party trackers.
• We do not run our own analytics 
• App stores (e.g. the Apple App Store, Google Play) may provide us with aggregate, anonymised statistics such as download counts, and — if you opt in to share diagnostics with the store — crash reports. This is governed by the store's own policies.

If you contact us for support, we receive whatever information you choose to include in your message (such as your email address and the details of your issue), and we use it only to respond to you.

06Children

Airtight is not directed at children, and we do not knowingly collect personal information from them.

07Your responsibilities

By using Airtight you agree that:

• You are responsible for safeguarding your master password, key files, and the devices on which you use the app.
• You are responsible for maintaining your own backups of your vault and credentials. Airtight provides no backup or recovery service.
• You will use Airtight only for lawful purposes and only with data you have the right to store and manage.
• You will not misuse the app, attempt to use it to gain unauthorised access to any system or account that is not yours, or use it in violation of any applicable law.

08Licence

Subject to these Terms, the Developer grants you a personal, non-exclusive, non-transferable, revocable licence to install and use Airtight on devices you own or control, for your own use.

You may not resell, redistribute outside permitted channels, reverse engineer except as permitted by law, or remove proprietary notices.

Some parts of the source code may be released for review purposes. These parts may not be used as a basis to create another product, and are not intended for compilation.

09Third-party software

Airtight builds on the KeePass database format and may include third-party open-source components, each under its own licence. The KeePass name and related marks belong to their respective owners; Airtight is an independent project and is not affiliated with or endorsed by the KeePass project.

10No warranty

Airtight is provided as is and as available, without warranties of any kind, whether express or implied, including but not limited to merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the app will be uninterrupted, error-free, or secure against every possible threat, or that it will meet your requirements.

Security software cannot guarantee absolute security. You remain responsible for the overall security of your devices, storage providers, and credentials.

Nothing in these Terms excludes, restricts, or modifies any guarantee, right, or remedy you may have under mandatory consumer protection law — including the Australian Consumer Law — that cannot lawfully be excluded.

11Limitation of liability

To the maximum extent permitted by law, the Developer will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of data, passwords, profits, or goodwill, arising out of or relating to your use of (or inability to use) Airtight, even if advised of the possibility.

Where liability cannot lawfully be excluded, our total liability is limited to the amount you paid for the app in the 12 months before the claim / the resupply of the app or payment of the cost of resupply

12Changes

We may update these Terms and this Policy from time to time. We will update the Last updated date and, for material changes, provide reasonable notice through the app or on our website at airtight.me. Continued use after changes take effect means you accept the updated version.

13Governing law

These Terms are governed by the laws of Queensland, Australia, without regard to conflict-of-law rules, and you submit to the non-exclusive jurisdiction of the courts located there. This does not deprive you of any protection under the laws of your own country of residence that cannot be excluded by agreement.

14Contact

Ink Software
airtight.me