We built TavKey with privacy at its core. The sections below explain exactly what data the app uses, where it goes, and why.
Who shares a signal. TavKey lets you share a private signal with a small group of people you trust - your trusted circle. They do not have to be related to one another; they can be relatives, friends, caregivers, or anyone you choose. TavKey never asks for, verifies, or records any relationship between them.
Scope. This policy covers the TavKey mobile app on Android and iPhone (iOS). The tavkey.com website and the mailing list are handled separately - see our Website Privacy Notice.
Who we are
TavKey (“we”, “us”) is developed and operated by Yaron Shemesh. The app is designed to avoid collecting personal information. There is no account, sign-up, or profile, and the app does not collect names, contact lists, phone numbers, or email addresses. We may process limited technical information, such as diagnostics or crash reports, as described in this policy, to keep the app reliable and secure. You can reach us any time at [email protected].
What we collect
No personal information. TavKey does not collect, store, or transmit any personal information about you. There is no account to create, no sign-up, no profile.
We do not use advertising SDKs or behavioral usage tracking. The only analytics we collect is anonymous diagnostics - reports of crashes and unexpected errors, plus an anonymous record of how each device-pairing attempt ended (success, failure, or canceled) - to fix bugs and reliability problems. This is on by default and you can turn it off at any time. See Crash & pairing diagnostics below.
We do not sell or share your personal information, we have never done so, and we do not use it for advertising or to build a profile of you.
How the signal works
The TavKey signal is generated entirely on your device. It combines a private shared secret with the current time to produce a color, an animal image, and a number - all without contacting any server.
Because all trusted phones share the same secret and use the same clock, they all show the same signal at the same time. No server is involved in computing or displaying the signal.
Pairing new phones
When you add a new phone, both devices need to securely share the shared secret. To do this, you and the new phone need to be together in person. When the two phones can reach each other directly over Bluetooth, they exchange the secret directly. Otherwise, a relay server helps the two phones find each other so they can complete the secure exchange. On Android phones that support NFC, you can also tap the two phones together to start pairing - the tap passes only a short one-time connection code, and the exchange itself then continues over Bluetooth or the relay as described above.
During pairing, a blind relay server helps coordinate the initial handshake. It forwards encrypted bytes between the two phones and cannot read any of the contents - it only sees ciphertext. All data on the relay is discarded immediately after pairing completes.
Data stored on your device
- Circle name - stored in plain text (non-sensitive label you chose).
- Shared secret - protected by your device's secure hardware: on Android it is encrypted with AES-256-GCM using a key held in the Android Keystore; on iPhone it is stored in the iOS Keychain, restricted to this device only and encrypted by the operating system. It never leaves your device in a readable form.
- Time offset - a small adjustment cached from a standard time-sync check, to keep your clock accurate.
Automatic cloud backup (such as Google Backup or iCloud) is explicitly disabled for the shared secret. It exists only on your device.
Network connections
TavKey connects to the internet for three purposes:
- Pairing relay - a relay server we operate on a cloud provider's network, used only during the few seconds of in-person pairing. Connection closes when pairing finishes.
- Time sync - a standard NTP request to a public time server (Google's time.google.com) to keep device clocks aligned. This is a 48-byte packet containing no identifying information, identical to millions of other NTP requests sent every day.
- Crash & pairing diagnostics - if diagnostics are enabled (the default, and you can turn it off), an anonymous report is sent when the app crashes or hits an unexpected internal error, or when a device pairing finishes. Pairing-outcome counts go to our own server; crash and error details, including unexpected pairing failures, go to our error-monitoring provider (Sentry, EU servers). See below.
The relay and diagnostics connections are encrypted in transit (HTTPS/TLS), and the pairing exchange itself is additionally end-to-end encrypted between the two phones, so even our own relay cannot read it. Aside from these, the app makes no other network requests - no advertising, no usage tracking, no background connections.
Crash & pairing diagnostics
To find and fix bugs, TavKey sends an anonymous diagnostic report when the app crashes or encounters an unexpected internal error. This is on by default so we can catch problems that happen during setup, but you can turn it off any time in the app under About → Send diagnostics.
A crash or error report contains only technical details: what went wrong (the error and the code path that led to it), the app version, and standard device diagnostics - your device's operating system and version, device model, and similar non-identifying information such as available memory and storage, battery level, language, and time zone. It deliberately does not include any personal information, screenshots of your screen, or any part of your shared secret or pairing data - those are stripped before anything is sent. Like any internet traffic, the report is delivered from your device's IP address, but the reporting service is configured not to record it or attach it to the report.
Separately, to catch reliability problems - for example a pairing failure that only affects a certain operating-system version - the app sends an anonymous record each time a pairing attempt ends: how it ended (success, failure, or canceled), whether your phone was the inviting or the joining one, which method was used (such as Bluetooth or the relay), and your device's model, operating-system version, and app version. These counts are recorded on our own server and contain no identifiers. When a pairing fails in an unexpected way, the same kind of anonymous technical detail described above is also sent to Sentry so we can fix it. No names, no identifiers, and no part of your shared secret or pairing contents are ever included, and the same on/off setting controls all of it.
Reports are processed by Sentry on servers in the EU. If you prefer to send nothing at all, switch the setting off.
Legal basis. Where the GDPR applies, we rely on our legitimate interest in keeping TavKey reliable, stable, and secure as the lawful basis for processing this anonymous diagnostic data. Because the data identifies no one and you can switch it off at any time, this processing has a minimal impact on your privacy. You can object to it whenever you like by turning diagnostics off under About → Send diagnostics.
Permissions
TavKey requests only the permissions it needs to pair phones and stay in sync:
- Internet - for the pairing relay, time sync, and the diagnostics described above.
- Bluetooth - to detect and communicate with a nearby phone during in-person pairing.
- NFC (Android only, optional) - on Android phones that support it, you can tap two phones together to start pairing. Otherwise phones pair over Bluetooth, or with help from the relay.
On some Android versions, the operating system itself requires a location permission before any app is allowed to scan for nearby Bluetooth devices. Where that applies, TavKey requests it only to find a nearby phone for pairing - never to determine where you are - and the app does not access your location in any way. On newer Android versions this is not required, because the app explicitly declares to Android that its Bluetooth scanning is never used to derive location. On iPhone (iOS), Bluetooth pairing never requires a location permission at all.
TavKey does not request access to your camera, microphone, contacts, or SMS messages.
Third-party code
TavKey uses only a small number of well-established, platform-standard libraries - for example for networking and cryptography - plus Sentry for the opt-out crash reporting described above. No advertising or usage-tracking SDKs are included.
Data retention
Because the app collects no personal information, there is nothing personal for us to retain. The anonymous crash and pairing diagnostics are kept only as long as they are useful for fixing reliability problems - currently 90 days, after which they are automatically deleted - and the pairing-outcome counts carry no identifiers. Everything else (the circle name, the shared secret, the time offset) lives only on your own device and is removed when you uninstall the app. One iPhone-specific detail: iOS may keep the encrypted secure-storage (Keychain) entry that holds the shared secret after the app is uninstalled. It stays encrypted, is not accessible to any other app, and TavKey deletes it automatically the next time the app is installed.
Your rights
Privacy laws such as the GDPR (Europe) and the CCPA (California) give you rights to access, correct, or delete personal data a company holds about you. Because TavKey is designed not to hold personal data about you, in practice there is nothing for us to look up, export, or erase on your behalf. If you believe we do hold personal data about you, email us and we will look into it and honor these rights.
If you are in the European Economic Area, the UK, or Switzerland, you also have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concerns first, so please feel free to contact us before you do.
The controls that matter to you are in your own hands: you can turn diagnostics off at any time under About → Send diagnostics, and uninstalling the app removes your data from your device (on iPhone, any leftover encrypted secure-storage entry is inaccessible to other apps and is wiped the next time TavKey is installed - see Data retention above). If you have any question about your rights, email us at [email protected].
International data transfers
The anonymous crash and error diagnostics are processed by Sentry on servers in the European Union. The pairing relay and the anonymous pairing-outcome counts run on our cloud provider's global network. Neither is designed to carry any personal data.
Children's privacy
TavKey is not directed at children under 13. In any case, the app does not collect personal information from anyone, including children - the only data it collects is the anonymous diagnostics described above, which identify no one.
Changes to this policy
If we change how the app handles data, we will update this page and the "Last updated" date above. Material changes will be highlighted here so you can see what changed.
Contact
Questions about this policy? We're happy to answer.
Email: [email protected]