Studio Keys is a password manager made by Circles Co Technologies LLC (“we” or “us”). This policy explains what we collect when you use studiokeys.app, my.studiokeys.app and the Studio Keys apps, why we collect it, who helps us run the service, and the choices you have.
The short version
- Your passwords, notes and other vault items are sealed on your device before they reach us. We cannot read them.
- We keep only the account details needed to run the service, bill you and keep your account safe.
- We do not sell or rent personal information, and we do not use advertising trackers.
- You can export your vault and delete your account at any time.
What we cannot see
Item names, usernames, passwords, websites, notes, folder names and Legacy instructions are encrypted on your device with AES-256-GCM using keys derived from your master password. We store only the sealed result. We never receive your master password, so we cannot reset it or open your vault. See Security for how this works.
What we collect
- Account details: your email address, name, optional profile photo and color, plan, and settings.
- Sign-in and security records: a hash of your sign-in proof (never your master password), two-step sign-in and passkey records, the devices you sign in on, and the IP address, browser or device type and times of sign-ins and sessions. We use these to protect your account and show you recent activity.
- Vault metadata: which account owns each sealed item and vault, counts, sizes and times. This helps us sync your devices and enforce plan limits.
- Sharing details: for Family, Teams, Legacy and attorney partners, the names and emails of the people you invite, their roles, waiting periods and request status.
- Billing details: your plan, invoices, receipts and payment status. Card numbers are entered with our payment processor, Intuit Payments Inc., and are not stored by us.
- Support messages: what you send us when you ask for help.
Names, emails, device labels and billing contact details are also encrypted at rest with a server key. That protects them in a stolen database, but unlike your vault, the service can read them to run your account.
How we use it
We use this information to create and run your account, sync your vault across devices, send sign-in codes, security alerts, Legacy notices, invitations and receipts, process payments, answer support requests, prevent abuse, and meet legal and tax obligations. We do not use your information for advertising or sell it to anyone.
Who helps us run the service
- DigitalOcean hosts our servers, databases, encrypted backups and public profile photos.
- Intuit Payments Inc. processes card payments.
- Resend delivers our emails, such as sign-in codes, alerts and receipts.
- Apple and Google deliver the mobile apps and any app notifications.
They receive only what they need to provide their service to us. We may also share information if the law requires it, to protect people from harm, or as part of a merger or sale of the service, in which case this policy continues to apply to your information.
What others can see
Profile photos and partner firm logos are public, so never use an image that shows a secret. People you share a Family or Team vault with can see your name, photo and the items in that shared vault. A beneficiary sees only the items you chose for them, and only after the waiting period. A linked attorney partner sees your name, plan, Legacy setup status, beneficiary count and last check-in, never vault or beneficiary details.
Cookies and local storage
The marketing site sets no cookies and runs no analytics. The app uses only the cookies it needs to keep you signed in and to protect forms from forgery. Your device stores its sign-in token, sealed vault copy and optional passkey wrapper locally.
How long we keep it
We keep your account information while your account is open. When you delete your account, your vault, devices, sign-in methods, Legacy settings, profile and photo are deleted right away. Payment records are kept as long as tax and accounting laws require. Encrypted backups expire within 30 days.
Your choices and rights
You can see and update your account details, download a sealed export of your vault, remove devices and photos, unlink an attorney partner, and delete your account from Account. Depending on where you live, you may also have the right to request a copy of your information, correct it, delete it, or object to how it is used. Email support@studiokeys.app from the address on your account and we will respond within 30 days. We will not treat you differently for using these rights.
Legal bases for people in the EEA, UK and Switzerland
We process your information to provide the service you signed up for (contract), to keep it secure and improve it (legitimate interests), to meet tax, accounting and other legal duties (legal obligation), and, for anything optional, with your consent, which you can withdraw at any time. You may also complain to your local data protection authority.
US state privacy rights
Residents of California and other US states with privacy laws may ask what personal information we hold, ask us to correct or delete it, and get a copy of it. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive information to infer things about you. You may use an authorized agent; we will verify the request with the email on your account.
Children
Studio Keys is not directed to children under 13, and we do not knowingly collect their information. Teens 13 and older may use it only with a parent or guardian's permission, for example on a Family plan. If you believe a child under 13 has an account, contact us and we will delete it.
Where we process data
Studio Keys is run from the United States, and your information is stored and processed in the United States.
Changes to this policy
If we make a material change, we will email you or show a notice in the app before it takes effect. The date at the top shows when this policy last changed.
Contact
Email support@studiokeys.app or use Help in your account.
Circles Co Technologies LLC
2301 SW 7th Ave
Amarillo, TX 79106
United States