Privacy Policy — Kutrion mobile app

In short

The app is a client for a Kutrion deployment. It talks to that deployment and to nothing else, apart from a check for app updates described below and pages you deliberately open in a browser. It contains no analytics, no crash-reporting service, no advertising identifier and no tracking of any kind, and it does not sell or share your data with anyone.

What the app keeps on your device

An offline vault cache, and it holds your credentials. So that AutoFill and the vault work with no network, the app keeps a copy of the vault items you are entitled to see — including the credential value itself, notes and key passphrases — in its own private storage on the device. That copy is encrypted with AES-GCM under a key the app holds only in the platform keystore: on iOS in the App Group container with complete file protection, its key in the Keychain behind Face ID or Touch ID; on Android in the app's private storage, its key wrapped by the Android Keystore. It is never written where another app can read it, and no plaintext credential material is stored at rest. Items your organization marks online-only are listed without their value and are never cached.

The cache is established when you sign in rather than by a separate opt-in, and it is destroyed when you sign out, when your organization revokes it, or when its key expires. Signing out is what removes it.

The app also stores, in the device's own encrypted keystore:

• Sign-in tokens — the token that keeps you signed in, and a second one issued to the AutoFill extension. The short-lived access token is held in memory only and is never written to disk.
• A device key — a private key generated on the device, which never leaves it; only its public half is sent to the server. When you have a biometric enrolled, reading it requires that biometric. When you have none enrolled, it is protected by the keystore alone, because there is no biometric to require.
• Your profile and preferences — your email address and display name, so the app can show who is signed in before it reaches the network, plus the server address, theme, language and auto-lock timeout.

Files you download through the app are written to its private cache folder unencrypted, the same as any file you save on the device, so that the system can open and share them. Audit exports go where you choose to save them.

What the app sends, and where

• To your Kutrion deployment — everything you do in the app: signing in, reading and editing vault items, opening SSH, RDP and file sessions, and browsing your audit trail. Terminal and remote-desktop sessions travel over a connection to that deployment, which brokers the session and holds the recording; the app creates no recording and no command history of its own.
• Device registration — the app registers itself so sessions can be attributed and revoked. It sends the platform (iOS or Android), a fixed label, and the public half of the device key. It does not send the name you gave your phone. It also reports, as answers it works out itself, whether the device has disk encryption, a screen lock and a biometric enrolled, and the operating-system version.
• AutoFill records — when AutoFill serves a credential from the offline cache, the app records that it did and uploads that record so the access appears in your organization's audit trail. That record names the app or website the credential was filled into.
• App updates — on launch the app checks an update service operated by Expo for a newer version of its own code. This is the one destination outside your Kutrion deployment that the app contacts on its own. No vault content, credential or audit record is sent to it.
• Pages you open — signing in with your organization's identity provider, connecting a cloud storage account, and paying an invoice each open that third party's own page in the system browser. Those are their pages under their own policies; the app sends them no credential of yours.

The app registers no push-notification token and sends no notification identifier.

Biometrics

The app asks the operating system whether the device has biometric hardware, whether a biometric is enrolled, and to unlock a key on your behalf. It never receives your fingerprint or face data and never sends anything derived from it. The only biometric-related fact that leaves the device is whether a biometric is enrolled at all, reported as part of device posture above.

Permissions the app asks for

On iOS: Face ID, to unlock your vault. On Android: biometric and fingerprint, for the same reason, plus network access, storage access so you can save audit exports and downloads where you choose, the ability to show a window over other apps, which AutoFill uses to present itself, and vibration. The app declares no camera, photo-library, contacts, location, microphone or calendar permission.

What happens on the server

Anything you do in the app is handled by the Kutrion deployment under the service privacy policy, which is the page to read for how long records are kept, who the subprocessors are and what does and does not leave the deployment. Two points from it matter to app users in particular: credential material is sealed at rest, and terminal recordings, their AI summaries and command history are not — they are stored so that you and your organization can read them back.

Deleting your account

You can delete your Kutrion account from inside the app, under Account, and from the web app. A deletion is scheduled rather than immediate: it runs after a waiting period, seven days by default, and we email you when you ask. You can cancel it from Account until it runs. Once it runs it is permanent: it removes your account and the data you own. The offline cache on a phone is removed when you sign out of the app on it. Audit records are retained as compliance records and keep the identifiers of what was erased. If you are the only owner of an organization with other members in it, the app will ask you to make someone else an owner first, so that the organization is not left with nobody who can administer it.

You can also request deletion without signing in.

Children

Kutrion is a tool for organizations administering their own systems. It is not directed at children and we do not knowingly collect data from them.

Changes to this policy

When this policy changes materially we update the date at the top of the page. The store listings point at this URL, so the current version is always the one published here.

Contact

Questions about this policy or your data: our contact page.