Privacy policy
What CryptoPad keeps on your phone, what it never collects, and how to remove it all — for iPhone and Android, and for this website.
Effective date: 1 November 2026
This policy covers the CryptoPad app for iPhone and for Android, and this website. Both are provided by Reliable Communications s.r.o., the controller of personal data for the purposes of this policy.
The short version
CryptoPad does not collect, send or share any data. The app has no account, no server and no network access. Everything you create in it stays on your phone, apart from backups of your phone that you make yourself (see “Backups”), and we never receive a copy. The only personal data we can ever hold is an email you choose to send us (see “If you contact us”) and, rarely, a visitor's IP address in an error log of this website (see “This website”).
What the app keeps on your phone
iPhone
| Data | Where it is kept | Who can see it |
|---|---|---|
| Your key pairs (name, public part, private part) | The iOS Keychain, readable only while the iPhone is unlocked and only on this device | Only CryptoPad on your iPhone |
| Contacts (a name you type and that person's public key) | A file in the app's own storage | Only CryptoPad on your iPhone |
| Text on the Pad (what you type, encrypt or decrypt) | The app's memory while it runs; it is not saved | Only you |
| Two settings (the key type you last chose, and a note that the app has been set up) | The app's own settings storage | Only CryptoPad on your iPhone |
Android
| Data | Where it is kept | Who can see it |
|---|---|---|
| Your key pairs (public and private part) | A file in the app's private storage, encrypted under a master key held in the Android Keystore of this phone. The names you gave your keys are kept next to them, not encrypted | Only CryptoPad on your phone |
| Contacts (a name you type and that person's public key) | A file in the app's private storage | Only CryptoPad on your phone |
| Text on the Pad (what you type, encrypt or decrypt) | The app's memory while it runs; it is not saved | Only you |
| One setting (the key type you last chose) | The app's private storage | Only CryptoPad on your phone |
None of this is sent to us or to anyone else. We cannot see, recover or delete it for you, because we never have it.
What we do not do
- No collection: the app makes no network connections at all. On Android it does not even ask for internet access.
- No analytics, crash reporting, advertising or tracking, and no third-party code that does any of these.
- No account or sign-in, and no request for your name, email or phone number.
- No sale or sharing of data, because the app gives us no data to sell or share.
Backups
iPhone
Your key pairs are stored as “this device only”: they are never moved to a different iPhone, neither from a backup nor by a data transfer. A backup can bring them back only to the same iPhone it was made on. Your contacts (names and public keys, nothing private) and the key type you last chose are part of the app's storage and may be included in a backup of your iPhone that you make to iCloud or a computer. Such a backup is held by you and Apple under your own account; we have no access to it.
Android
Android can copy an app's storage into your Google account backup, if backup is turned on for your phone, and onto a new phone during a phone-to-phone transfer. CryptoPad does not opt out of this, so such a copy may include its storage: your contacts, the key type you last chose, and the file that holds your key pairs with their names.
In that file your keys are encrypted under a master key in the Android Keystore of your phone. Android does not let that master key leave the phone, so the keys in that copy cannot be decrypted on another phone, or by anyone who gets hold of the backup, including Google and us. The names of your keys, and your contacts, are not encrypted by CryptoPad. The backup itself is held by Google under your own account; we have no access to it.
The clipboard
CryptoPad puts text on the clipboard only when you tap a copy button, and reads it only when you tap a paste button. Private keys are never copied to the clipboard.
- Copy Public Key copies one of your public keys, which is meant to be shared. On iPhone it sits next to the key under Your Keys; on Android it is in the key's ⋮ menu.
- Copy Output copies the current result on the Pad: the encrypted message after you encrypt, or the readable text after you decrypt.
- Paste on iPhone, Paste Input and Paste from Clipboard on Android put the clipboard's text on the Pad or into a new contact's key.
The clipboard belongs to the phone's system, not to CryptoPad. On iPhone, other apps you use can read it, and with Universal Clipboard it may appear on your other Apple devices. On Android, the system may briefly show what you copied on screen, and your keyboard may keep a clipboard history. Copy decrypted text only when you need to, and clear the clipboard when you are done.
Deleting your data
iPhone
- A key: in the Settings tab, swipe the key to the left, tap Delete and confirm. Messages encrypted for that key can no longer be opened.
- A contact: in the Contacts tab, swipe the contact to the left, tap Delete and confirm.
- Pad text: tap Clear, or close the app (swipe it away in the app switcher); CryptoPad never saves it. iOS keeps a picture of the last screen for the app switcher, so tap Clear before leaving the app while decrypted text is showing.
- Everything: delete the app. iOS removes its storage, including your contacts; a copy of your contacts may stay in an iCloud or computer backup made earlier. iOS can keep Keychain entries after an app is removed; they cannot be read by other apps, and CryptoPad erases any keys left from a previous install the first time it is opened again. To be sure your keys are gone at once, delete them in the app before you delete the app.
Android
- A key: in the Settings tab, open the ⋮ menu next to the key, tap Delete and confirm. Messages encrypted for that key can no longer be opened.
- A contact: in the Contacts tab, open the ⋮ menu next to the contact, tap Delete and confirm.
- Pad text: tap Clear, or close the app (swipe it away in recent apps); CryptoPad never saves it. Android keeps a picture of the last screen for recent apps, so tap Clear before leaving the app while decrypted text is showing.
- Everything: uninstall the app. Android removes its storage and its master key in the Keystore, so your private keys are gone at once. A copy of the app's storage in your Google backup (see “Backups”) may stay there until Google replaces or removes it; the keys in it cannot be opened without the master key that was removed with the app. If you install CryptoPad again, Android may bring your contacts back from that backup, but not your keys.
We hold no data from the app, so there is nothing from it to ask us to delete. If you have emailed us, see the next section.
If you contact us
If you write to us, we receive your email address and whatever you put in the message.
- Purpose: only to answer you and to deal with what you asked about. We do not add you to any mailing list.
- Legal basis: our legitimate interest in answering messages sent to us (Article 6(1)(f) GDPR), or steps you ask us to take (Article 6(1)(b)).
- Retention: we keep the correspondence for no longer than 12 months after our last reply, then delete it, unless the law requires us to keep it longer.
- Sharing: with no one except our email provider, Google (Google Workspace), which processes the mail on our behalf under its data processing terms and may not use it for its own purposes. Google may process it outside the EU/EEA; such transfers rely on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
Please do not send us private keys or decrypted messages; we never need them.
This website
This site sets no cookies, has no analytics and loads nothing from third parties: no fonts, scripts or images from other servers. It remembers the theme and language you choose in your browser's own storage; that stays in your browser and is never sent to us.
The server keeps no access logs: there is no record of who opened which page. A rare server error may be written to a short technical log that can include the visitor's IP address; it is kept only until it is overwritten automatically. The site is hosted by OVH (OVH GmbH, in Germany, in the EU), which processes IP addresses only to deliver the pages. We do this on the basis of our legitimate interest in running the site safely (Article 6(1)(f) GDPR).
Your rights
For any personal data we process under this policy, whether an email you sent us or the technical data of a visit to this site, you can ask us to see, correct or delete what we hold, restrict its use, receive a copy in a portable form, or object to its use, by writing to info@relcom.com. You can also complain to the Czech data protection authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).
Children
CryptoPad is not directed at children and collects no data from anyone, including children.
Changes to this policy
If this policy changes, we will publish the new version at this address with a new effective date. If a future version of the app ever began to collect data, we would say so here and in the app store privacy sections before that version is released.
Contact
Reliable Communications s.r.o., Prokopova 2856/10, 130 00 Praha 3, Czech Republic. Email: info@relcom.com.