How UnderKey Works

UnderKey is an offline encrypted document vault. Every document, photo, and note you store is encrypted with AES-256 on your device and never sent to us or anyone else. This page explains exactly how that works, what stays on your device, and what third parties are involved.

What stays on your device

Everything:

• Documents, photos, scans, and secure notes (encrypted with AES-256-GCM).
• Filenames, notes, and tags (encrypted).
• Expiry dates (encrypted and used to schedule local reminders).
• Vault metadata (number of items, last access time — all encrypted).

All of this is stored in your device's app sandbox, which is isolated from other apps and protected by iOS or Android's security model.

What never leaves your device

Your documents, unlock patterns, encryption keys, and metadata are never uploaded. UnderKey has no servers to upload them to. There is no sync, no cloud backup, and no remote copy of your data.

This means:

• No account to hack. There's no username, password, email, or login. You open the app, draw a pattern, and your vault exists — only on your phone.
• No server to breach or subpoena. Because your documents never leave your device, there's no remote copy for anyone to request, seize, or leak.
• No cloud provider to trust. You're not relying on iCloud, Google Drive, or any other service to keep your data private.

How encryption works

1. You draw an unlock pattern. This can be any shape on a 3×3 to 6×6 grid (configurable).
2. UnderKey hashes your pattern using PBKDF2 (Password-Based Key Derivation Function 2) with a unique salt to produce a 256-bit encryption key.
3. That key encrypts and decrypts your documents using AES-256 in GCM mode (Galois/Counter Mode), which provides both confidentiality and authentication.
4. The key exists only in memory while the app is unlocked. When you lock the app or leave it, the key is erased from memory. It's never written to disk.
5. Your pattern itself is never stored. UnderKey stores only the salt and an encrypted test value. When you unlock, your pattern is hashed again, and if the hash matches, the vault unlocks. If it doesn't, the vault stays locked.

This design means the only way to decrypt your documents is to know the unlock pattern. If you forget it, the documents are permanently inaccessible — including to us, because we don't have the key and we never saw your documents.

What third parties are involved

UnderKey uses a small number of third-party services for specific features. Here's what they do and what data they see:

Google ML Kit (on-device OCR)

When you scan a document, UnderKey uses Google ML Kit Text Recognition to suggest expiry dates automatically. This happens entirely on your device:

• Your documents are not uploaded. ML Kit processes the image on your device and does not send it to Google or UnderKey.
• On iOS: ML Kit is bundled inside the app. No additional downloads are required.
• On Android: Google Play Services may download a text recognition component via a one-time system-level download the first time you use the OCR feature. Once downloaded, all text recognition runs on-device.

For Google ML Kit's data practices, see Google's ML Kit Terms.

RevenueCat (subscription management)

When you purchase UnderKey Pro (weekly, yearly, or lifetime), payment is handled by the App Store or Google Play Store. UnderKey uses RevenueCat to verify your purchase and manage your subscription status.

• RevenueCat processes your purchase receipt and an anonymous user identifier. This identifier is randomly generated and is not linked to your email, name, or any personally identifying information.
• RevenueCat does not have access to your documents, photos, or vault contents.
• We never see your payment details, email, or identity. That information is handled entirely by Apple or Google.

For RevenueCat's data practices, see RevenueCat's Privacy Policy.

Apple and Google (payment and platform services)

iOS and Android platforms provide the underlying security, payment processing, and notification services:

• Payments are handled by the App Store (iOS) or Google Play Store (Android). Your payment details and purchase history are subject to Apple's Privacy Policy or Google's Privacy Policy.
• Notifications for expiry reminders are scheduled locally using iOS or Android's native notification system. No server is involved.
• iOS document scanner uses Apple's built-in VisionKit framework for edge detection. This runs on-device and does not upload your documents.

What we don't collect

UnderKey collects no analytics, no telemetry, and no usage data. We don't track:

• How many vaults you have.
• How many documents you've stored.
• What types of documents you're storing.
• How often you unlock the app.
• Your location, IP address, or device identifiers.

We can't collect this data because UnderKey has no servers and makes no network requests beyond the initial purchase verification.

Platform permissions

UnderKey requests the following permissions:

• Camera: to scan and photograph documents. The scanner uses on-device edge detection. Photos are encrypted before they're saved.
• Photo Library: to import existing photos or documents from your device.
• Files/Documents: to import documents from your device's file system.
• Notifications: to remind you before documents expire. Reminders are created locally and never sent to a server.

All permissions are optional. You can deny them and still use the app, though some features (scanning, importing, reminders) will be unavailable.

Screenshot and screen recording protection

• Android: UnderKey blocks screenshots and screen recordings while the app is unlocked, and blurs the app preview in the app switcher.
• iOS: iOS does not provide a way for third-party apps to fully block screenshots. UnderKey blurs the app preview in the app switcher, but cannot prevent screenshots while the app is in use.

Open questions

Can UnderKey see my documents?

No. Everything is encrypted on your device before it's stored. We don't run servers that could receive your files, and we never see your unlock pattern or encryption key.

What if you're subpoenaed or compelled to hand over my data?

We can't. Your documents never reach us, so we have nothing to hand over.

Can I trust that there's no backdoor?

UnderKey's architecture makes a backdoor impossible: your unlock pattern derives the encryption key on your device, and that key never leaves your device. There's no master key, no recovery mechanism, and no way for us to decrypt your vault even if we wanted to. If you forget your pattern, your documents are permanently inaccessible — including to us.

What if I lose my phone?

Your documents are gone. There's no cloud backup to recover from. This is a deliberate trade-off: the privacy and security of offline storage means you're responsible for backups. Keep printed copies of critical documents (passports, IDs, insurance policies) somewhere safe at home.