Privacy Policy

Last updated: April 18, 2026

Titanium Passkey (“the App”) is developed by Mediaware, s.r.o.. This policy explains how the App handles your data.

The short version

Your passkeys never leave your device. The Credential Provider extension — the part that handles every passkey — ships without a network entitlement and is technically incapable of making outbound connections. The host app reaches the network for one thing only: fetching each site’s favicon for your passkey list. There is no analytics or tracking SDK; the only diagnostic data we ever receive is anonymized crash reports, and only if you have opted into sharing them via iOS system settings.

What is a passkey?

A passkey is a pair of cryptographic keys (public and private) that replaces a password for a specific website or app. The public half is stored on the site’s server. The private half stays with you, and is used to prove your identity by producing a signature. For every passkey you create with Titanium Passkey, the private half is generated inside the device’s Secure Enclave and never leaves it.

Data Collection

The App does not collect, transmit, or share any personal data. Specifically:

• No analytics or usage tracking
• No advertising identifiers
• No cookies, fingerprinting, or device profiling
• No passkey data is ever transmitted off the device
• No account to create — we don’t know who you are

Data Storage

Passkey credentials are stored exclusively on your device using the following security measures:

• Secure Enclave keys: Every passkey’s private key is an EC P-256 key generated with kSecAttrTokenIDSecureEnclave. The private key material never exists outside the Secure Enclave and is not extractable by the App, by iOS, or by Apple.
• Biometric protection: Every signing operation requires Face ID or Touch ID authentication enforced by SecAccessControl with the biometryCurrentSet and privateKeyUsage constraints. If your biometric enrollment changes, existing keys become permanently unusable.
• Device-bound: Keys and metadata are marked with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, which excludes them from iCloud Keychain sync, iTunes backups, and Finder backups.
• No sync: The App does not synchronize data to any cloud service or other device. Passkeys created on one device exist only on that device.
• App Group isolation: Data is shared between the main app and the Credential Provider extension via an App Group and a shared keychain access group, both scoped to the App’s bundle identifier. No other app can see this data.

Biometric Data

The App uses Face ID or Touch ID solely to authenticate access to passkey signing operations. Your biometric data is processed entirely by the iOS Secure Enclave and is never accessed, read, or stored by the App. We only ever receive a boolean result: authentication succeeded, or it did not.

If you re-enroll your biometrics (for example, set up a new Face ID), the Secure Enclave keys created under the previous enrollment are automatically invalidated, permanently erasing access to every passkey. This is a deliberate security property, not a bug.

Credential Provider Extension

The App registers a Credential Provider extension via Apple’s AuthenticationServices framework. When you sign in to a passkey-capable website or app and select Titanium Passkey from the AutoFill sheet, iOS launches the extension in a short-lived, sandboxed process. The extension reads the challenge, signs it inside the Secure Enclave, and returns the signature to iOS. The extension is built without a network entitlement and cannot make outbound connections at all (see Network Access below).

Network Access

The Credential Provider extension — the sandboxed process iOS launches to read passkeys during sign-in — is built without the network client entitlement. It is technically unable to make outbound HTTP, TCP, or UDP connections.

The host app carries a network client entitlement for one purpose only: fetching the favicon of a relying-party website over HTTPS so that your passkey list shows a recognisable icon next to each entry. Only the relying-party hostname (the public identifier the site chose for itself and already sent us during registration) is used to build that request. No passkey data, no user handle, no metadata derived from the private key is transmitted. If the favicon fetch fails, the app falls back to a placeholder glyph.

There is no “phone home,” no analytics, no update check from the App itself, and no remote configuration. The App relies entirely on the iOS App Store mechanism for updates.

Crash Reporting

We bundle no crash-reporting or analytics SDK in the App, so any crash diagnostics we receive come solely through iOS’s built-in Share Analytics with App Developers mechanism. If you have opted in via Settings → Privacy & Security → Analytics & Improvements, iOS will forward anonymized crash reports to Apple, who makes them available to us. These reports contain:

• Device model and iOS version
• Stack trace and error description
• A random install UUID that cannot be tied to your Apple ID

Crash reports never contain passkey data, relying party IDs, user handles, display names, or any information about the sites you authenticate with. If you have not opted in, no crash reports are sent.

Third-Party Services

The App uses no third-party services. It embeds the open-source libraries listed in the in-app Acknowledgements screen for cryptographic operations (Apple CryptoKit, Apple Security framework, PointFree’s Composable Architecture, and Mediaware’s internal Logger and SecretStore packages). None of these libraries perform network communication from within the App.

Children’s Privacy

The App does not knowingly collect data from anyone, including children. Since the App collects no data at all, no special provisions for children are necessary.

Data Deletion

You can delete any stored passkey at any time from within the App’s passkey list. Deleting a passkey removes both the Secure Enclave key and its associated metadata. Deleting the App from your device permanently removes every stored passkey. Because there is no cloud backup, deleted passkeys cannot be recovered — this is by design.

Your Rights (GDPR)

Titanium Passkey is designed so that GDPR’s data subject rights are satisfied structurally:

• Right to access: All passkey data is visible to you in the App; there is no server copy to request.
• Right to erasure: Delete a passkey, or delete the App, and the data is gone.
• Right to portability: Passkeys are intentionally non-portable by design; this is a security property, not a compliance gap.
• Right to object: There is no processing to object to; we hold no data about you.

Changes to This Policy

If this privacy policy changes, the updated version will be posted at this URL. The App has no analytics channel or push mechanism — its only network use is fetching site favicons — so it cannot notify you of policy changes directly. We recommend checking this page if you are concerned about changes.

Contact

If you have questions about this privacy policy, contact:

Mediaware, s.r.o.
Banská Bystrica, Slovakia
[email protected]