Legal

Privacy Policy

Effective November 1, 2026

Cuxtodi is built so that we can’t read your vault. This page explains, in plain language, what data the Cuxtodi apps and this website handle, what we can and can’t see, and the choices you have.

The short version

Your vault is encrypted on your device. We can’t read your passwords, passkeys, API keys or notes.
We never see your master password, and we can’t reset it or recover your vault if you lose it.
Face ID and Touch ID stay on your device. We receive no biometric data.
The apps have no ads, no analytics and no tracking SDKs. We don’t sell your data.
This website has no analytics and no advertising or tracking cookies.

Who we are

The Cuxtodi team is responsible for the personal data described on this page (the “controller”). You can reach us at [email protected].

Your vault

Everything you store in Cuxtodi (passwords, passkeys, API keys and notes) is encrypted on your device before it is saved or synced. Your keys are derived from your master password and your Secret Key with Argon2id, your data is encrypted with AES-GCM, and Ed25519 digital signatures are used as well.

We never receive your master password or your Secret Key. That means nobody, including us, can reset your master password or recover your vault if you lose it. Keep your Emergency Kit (your account ID and Secret Key) somewhere safe: you need it, with your master password, to sign in on another device.

Sync is optional. When you turn it on, only encrypted data leaves your device. The sync server stores encrypted blobs it can’t read, plus the account details it needs to sign you in: your account ID, your email address and sign-in data created on your device (never your master password).

So that AutoFill works while Cuxtodi is locked, an encrypted copy of your passkeys stays on your Mac, protected by a key that needs Touch ID or your Mac password.

Face ID and Touch ID

Cuxtodi uses Apple’s Face ID and Touch ID to unlock your vault and to approve actions. Your face and fingerprint data are handled by your device and never leave it. Cuxtodi only learns whether the check succeeded, and we receive no biometric data.

Agent Vault (preview)

AI agents you pair use your keys through cx:// references and never see the values. Cuxtodi injects a key only into requests to the domains you allowed for it, or into a program you start yourself with cuxtodi run. You can make access expire, and Stop all agents cuts off every agent at once.

The activity log of what your agents used stays on your device. It is not sent to us.

App updates

The Mac app checks for updates about once a day by downloading a small file from cuxtodi.app. Like any web request, it includes your IP address and the app’s name and version, and it is handled by Cloudflare, our hosting provider. The update check sends no information about your vault or your Mac.

Beta crash reports and feedback

If you test Cuxtodi through Apple TestFlight, crash reports and the feedback you send are collected by Apple under Apple’s terms and privacy policy, and Apple shares them with us so we can fix problems. The apps themselves contain no crash-reporting or analytics SDKs.

The waitlist

When you join the waitlist on this website, we store:

your email address;
the language of the page you used (English or Spanish);
the date and time you signed up;
your browser’s user-agent string (which browser and operating system you use);
a salted, one-way hash of your IP address, to help spot abuse (we never store the IP address itself);
whether the notification email to our team was sent.

The form is protected by Cloudflare Turnstile, which checks that you’re a person. To do that, Cloudflare processes your IP address and signals from your browser under its own privacy policy.

Signups are stored in a Cloudflare D1 database, and each new signup (email, language, time and site) is emailed to our team inbox. We use this only to manage the beta and to contact you about it. We keep your entry until you ask us to delete it or the beta program ends.

This website

This website is hosted on Cloudflare Pages. It uses no analytics, no advertising or tracking cookies and no third-party trackers. Cloudflare processes standard request data, such as your IP address and browser, to deliver the site and protect it from attacks. The Turnstile check loads from Cloudflare only on pages with the waitlist form.

Your privacy rights

Wherever you live, you can ask us to:

tell you what personal data we hold about you and give you a copy;
correct it;
delete it, including your waitlist entry or your sync account;
send it to you in a portable format;
stop or limit using it, or withdraw your consent (for example, to leave the waitlist).

If you’re in the European Economic Area or the United Kingdom (GDPR): we rely on your consent for the waitlist, which you can withdraw at any time, and on our legitimate interest in keeping the service secure and free of abuse. You can also complain to your local data protection authority.

If you’re in California (CCPA/CPRA): you have the right to know, delete and correct your personal information. We don’t sell or share personal information for cross-context behavioral advertising, and we won’t treat you differently for using your rights.

To make a request, email [email protected]. We may need to confirm that you control the email address involved, and we’ll reply within 30 days. We can’t read or hand over the contents of your vault, because only you hold the keys.

Children

Cuxtodi isn’t intended for children under 16, and we don’t knowingly collect their personal data.

Security

Cuxtodi is beta software, and its cryptography and code have not yet been independently audited. Keep a backup of important data.

Changes to this policy

If we change this policy, we’ll update this page and its effective date. If the change is significant, we’ll also let you know in the app or by email.

Contact

Questions or requests about your privacy: [email protected].