Privacy Policy

Last updated 10 November 2026

Guardikey is built so that we cannot see your secrets, even if we wanted to. This policy explains the little data we do handle, why, and the rights you have over it.

Zero-knowledge in one line. Your passwords, payment cards, crypto wallet, messages and master password are encrypted on your own device before anything leaves it. We never receive your master password or the keys to open your vault, so your contents are unreadable to us, to our hosting provider, and to anyone who intercepts them.

1. Who we are

Guardikey is a product of Apexium Technology, a registered sole proprietorship based in Antalya, Türkiye (the “we”, “us”, or “Provider”). For any privacy question, contact [email protected]. For personal data you provide to us for your account and sync, we act as the data controller; for the encrypted vault data we move between your devices, we are only a processor and cannot read it.

2. What we never have

By design, we do not hold and cannot access:

Your master password — it never leaves your device, not even during sign-in (we use the OPAQUE protocol, which proves you know it without transmitting it).
Your vault contents — passwords, payment cards, notes, files, messages, and your crypto wallet seed. These are encrypted on your device; we only ever see opaque ciphertext.
Your encryption keys. We cannot decrypt your data, reset your master password, or recover your vault for you. That is the point of zero-knowledge.

3. What we do process

Account data: your email address and an authentication record derived from your password that cannot be reversed into the password. Used to create your account and let you sign in.
Encrypted sync data: opaque encrypted blobs that carry your vault between your phone and computer. We store and relay them; we cannot open them.
Device data: a device name and identifier you set when you link a device, so you can see and manage your own devices and we can enforce your plan’s device limit.
Billing data: handled by our reseller Paddle (see §6). We receive only the subscription status and the email tied to it — never your full card number.
Support data: if you email us, we keep your message and address to reply.
Minimal site analytics: aggregate, privacy-respecting visit statistics for this website. No cross-site tracking, no advertising profiles.

4. Why we process it (lawful basis)

Under the GDPR we rely on: performance of a contract (to provide the account, sync and subscription you asked for); our legitimate interests (keeping the service secure, preventing abuse, understanding aggregate usage); and consent where required (for example, any non-essential cookies). You can withdraw consent at any time.

5. How long we keep it

We keep account and encrypted sync data for as long as your account exists. When you delete your account, your account record and encrypted blobs are removed. Billing records are retained by Paddle and by us only as long as tax and accounting law requires. Support emails are kept while they are useful to help you, then deleted.

6. Payments and our Merchant of Record

Our order process is conducted by our online reseller Paddle.com. Paddle.com (Paddle.com Market Limited) is the Merchant of Record for all our orders, handles the payment, tax and billing, and provides customer service and returns for purchases. Your payment details are processed by Paddle under its own privacy policy and buyer terms — see paddle.com/legal/privacy.

7. Who we share data with (subprocessors)

We use a small set of trusted providers, strictly to run the service:

Cloudflare — hosting of our API, database and encrypted-sync storage (the data it stores is encrypted and unreadable to it).
Paddle — payments, tax and billing, as Merchant of Record.
Resend — sending transactional emails such as your activation code.

We never sell your personal data, and we do not share it for advertising.

8. International transfers

Our providers may process data in the EU, UK, US and other regions. Where data leaves your region, transfers rely on appropriate safeguards such as the providers’ Standard Contractual Clauses. Because your vault data is end-to-end encrypted, its contents remain protected wherever it is stored.

9. Your rights

Depending on where you live, you have rights over your personal data. Under the GDPR: access, rectification, erasure, restriction, portability, and the right to object. Under the CCPA/CPRA (California): the right to know, delete, correct, and to opt out of any “sale” or “sharing” — which we do not do. To exercise any right, email [email protected]; we respond within the time the law allows. You may also lodge a complaint with your local data protection authority.

10. Cookies

This website uses only essential cookies needed for it to work, plus any cookies set by the Paddle checkout during a purchase. We do not use advertising or cross-site tracking cookies. Where non-essential cookies are ever used, we ask for your consent first and honour Global Privacy Control signals.

11. Children

Guardikey is not directed at children under 16, and we do not knowingly collect their personal data.

12. Changes

We may update this policy as the product or the law evolves. Material changes will be reflected by the “last updated” date above, and where appropriate we will notify you.

13. Contact

Apexium Technology — [email protected]. Billing and refund questions are handled by Paddle as our Merchant of Record.