Updated October 17, 2026.
Connections and authentication
Keyhelm is an independent iPhone app for the Vault servers you configure. We do not operate a Vault account service, hosted relay, or secret backup service. Vault API requests go directly to your configured server. Browser sign-in also communicates with the identity provider configured by your Vault administrator. Those operators control their own access logs and retention policies.
Data on your iPhone
Server addresses, namespace paths, authentication settings, selected connections, and app preferences are stored in a local SQLite database. Saved Vault tokens use Keychain/SecureStore in Keyhelm’s separate app and build-flavor namespace. Sign-in passwords, JWTs, one-time codes, browser authorization codes, and wrapping tokens are not saved as connection metadata. A successful sign-in stores the issued Vault token for subsequent access.
Keyhelm does not maintain a persistent offline cache of Vault secret responses or policy source. Read content is held in memory while the app uses it. If you copy, export, or share content, it can be retained in the clipboard, files, or receiving apps you choose. Protect that content according to your organization’s rules.
Sign Out removes the selected local connection and credential; Remove can remove a server’s saved connection. These actions do not delete Vault secrets or revoke tokens on the server. Local metadata can be included in device backups; local removal does not erase earlier backups. iOS controls Keychain and backup behavior, so uninstalling the app is not a promise that every system-held copy has been erased.
Purchases and access checks
RevenueCat processes purchase and entitlement information using an app purchase identifier and technical information needed to provide its service. App Store purchases, when available, are processed by Apple. Keyhelm disables RevenueCat’s automatic device-identifier collection and diagnostics. Vault addresses, namespaces, credentials, secret values, and policy source are not supplied as RevenueCat customer attributes.
Development and test builds use RevenueCat’s Test Store. Its purchase flows are simulated and do not charge real money. Purchase-related information is still processed by RevenueCat. For provider practices, see RevenueCat’s Privacy Policy.
Diagnostics and tracking
Keyhelm does not include advertising, behavioral analytics, session replay, or a developer-operated crash-reporting service. Development builds can expose runtime logs to connected development tools. This does not make support messages or third-party service requests anonymous.
Website and support
This website uses no cookies, analytics scripts, browser scripts, or remote fonts. Cloudflare processes requests, including network information such as your IP address, to serve and protect the site. See Cloudflare’s Privacy Policy. If you email support, we receive the information you choose to send. The app’s contact action prepares an email draft with the app and iOS versions; you decide whether to send it. It does not attach Vault connection data or diagnostics automatically.
Contact and privacy requests
Email keyhelm@khalidwar.com with questions or requests concerning information you have sent to support. Do not include tokens, passwords, secret values, or unredacted server data.