Privacy Policy

The phone apps

The phone apps work only while every radio is off, and send nothing anywhere: the Android app does not even have the permission to use the internet. Your recovery phrase and passphrase stay in the phone’s memory while the wallet is open and are wiped when you close it; nothing is written to the phone’s storage or included in backups.

The camera reads codes — the web companion’s, or a SeedQR — on the phone itself. Images are not stored and never leave the phone. On iPhone, Airkeys asks for Bluetooth permission only to check that Bluetooth is off; it never uses Bluetooth.

Codes the phone shows carry addresses and signed transactions, never a key. You choose which accounts to show.

The web companion

The web companion runs in your browser. It keeps the addresses your phone shared and your settings in your browser’s local storage, on your computer only, until you remove them. It sets no cookies and loads no analytics or third-party scripts. The camera is used in the browser to read the phone’s codes; images are not uploaded or stored.

To show balances and send transactions, your browser connects directly to blockchain endpoints: by default public services listed in Airkeys (such as mempool.space, blockstream.info and publicnode.com), or the nodes you set in Settings. Those services see your IP address and the addresses asked about, and can tell that addresses asked about together belong together. Using your own nodes avoids this.

To show values in currencies other than US dollars, the web companion fetches exchange rates from Vela’s exchange-rate service; when you add a network or a token, it fetches its details from ethereum-data.getvela.app, and it shows token and network logos from the same site. None of these requests includes an address. Token prices in US dollars come from Chainlink feeds, read through the same blockchain endpoints.

This website

The server that delivers airkeys.app’s files may keep standard technical logs, such as IP address, time and page requested, for security and operation, for a limited time.

The landing page and these documents count visits with Rybbit, an open-source analytics tool hosted at tj.appsdata.org. It records the pages you view and their query parameters, the page that linked you here, the links you follow to other sites, your browser, language, screen size and approximate location (from your IP address), and keeps a random visitor ID in your browser’s local storage. It sets no cookies. The web companion (airkeys.app/app/) and the browser extension do not load it.

App stores and payments

If you buy the phone app, Google Play or the App Store processes your payment and handles your account under their own privacy policies. They send us the sales reports every developer receives, which may include your country or region and the order details, but never your payment details or anything about your wallet.

What we do not do

We do not sell or share personal data, build profiles, show advertising or track you across sites or apps. Apart from the visit counts above, we do not collect personal data; to ask about those, write to us. To erase what the web companion keeps, use “Forget all accounts” in Settings or clear the site’s data in your browser.

Email

If you write to us, we use your address and your message only to reply, and keep them only as long as the conversation needs.

Children

Airkeys is not directed at children and does not knowingly handle their data.

Changes

If what Airkeys handles changes, we update this policy and the date at the top. The source code is public, so you can always check what the apps actually do.

Contact

MONDAY LABS LTD · Questions about these terms or this policy, and security reports: hello@mondaylabs.ltd