Privacy

What Innkeeper holds, and what it does not

This covers the Innkeeper app for iPhone, the Innkeeper app for Mac, and this site. All of them are made by A2W. Effective 15 September 2026.

The short version: your phone holds the secrets, your Mac holds no credential at rest, and when the two are apart they meet in your own iCloud, in envelopes Apple cannot open. We run no server between them, no accounts, no analytics and no tracking. Nothing about you is collected by us.

Who is asking, and where the answers go

Innkeeper is the gate between software you run and the accounts you own. The software is yours: an agent, a coding tool, a script, running on your Mac and chosen by you. It asks; you approve on your phone; the Mac makes the one call you approved and hands the answer back to that software. A2W runs no agent and no model, and nothing of ours sees the request or the answer. What that software does with an answer afterwards is governed by its own setup and its own policy, not by this page.

What the iPhone app holds

A signing key made in the Secure Enclave, which never leaves the phone and will not sign without your face. A vault: the secrets you paste and the sign-ins you connect, each sealed with a vault key. That vault key is wrapped to a Secure Enclave key, which is why reading a secret takes a face, and a copy of it is kept in your iCloud Keychain so a replacement phone signed into the same Apple account can recover the vault. That copy is the lost-phone trade: whoever controls your Apple account and one of your trusted devices could recover the vault key, which is what iCloud Keychain means. The Macs you have paired: their names, addresses and keys, and a secret agreed at pairing. Ten recovery codes, shown once; the Mac keeps only their hashes. The most recent requests, cached so the list draws before the network answers. None of it is sent to us.

A secret leaves the phone only inside an approval you gave with your face, sealed to the one Mac that asked, for one call.

What the Mac app holds

No credential at rest. When you approve a call, the Mac holds the credential in memory for at most two minutes, attaches it to exactly one request, and overwrites it. It keeps the list your phone announced: the names of your secrets and where each may be sent, never a value. It keeps a log on your Mac of who asked, for what, when, the verdict, and how long you took, with names and never a value. It keeps your phone's push token, so it can ring your phone through Apple. If you turn the tripwire on, it keeps a fitted profile of how you write, which you fed it. All of this stays on your Mac.

Connected services

Connecting a service is optional. A sign-in, to Google, GitHub, GitLab, Discord or Microsoft, runs on your phone against the provider's own page; a token, for Jira, Slack, Notion, Linear, Stripe, Cloudflare or Vercel, is pasted on your phone from the provider's own token page. Before either you tick what an agent may do, and the provider is asked for only that. The sign-in itself, the refresh token, never leaves the phone. For each call you approve, the phone renews the short-lived access token if it needs to and seals only that to your Mac.

The Mac refuses a request outside what you ticked before you are asked: the wrong host, the wrong method, the wrong path. What the provider answers goes back to the software that asked, on your Mac, and nowhere else. A2W never sees the sign-in, the token or the answer.

Google.When you connect Google you may allow an agent to read, send and organise your Gmail, to read and change your calendars and events, and to find, read, create and change files in your Drive, according to what you ticked. Innkeeper's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not use it to train models, general or otherwise; we never hold it. It goes from Google to your Mac to the software you approved, at your approval, and to no one at A2W.

Forget on the phone deletes a sign-in or token from the vault and tells your Macs. Revoking Innkeeper in the provider's own account settings ends its access from that side too. Neither undoes a mail already sent or a file already changed.

What travels, and who can see it

At home, requests and answers go between your phone and your Mac over your own network, sealed to keys the two agreed at pairing. When your phone is elsewhere, the Mac leaves each request in a private zone of your own iCloud, sealed to your phone's key with a post-quantum envelope, and the phone's answer comes back the same way. Nobody runs a server for this, not A2W, not you. Apple holds sealed records and their names and when they were written; it cannot open one. You can turn this off on the Mac and the apps speak only on your own network.

Apple's push service rings the phone. A push says that something is waiting and nothing else; the request itself is collected by the app, sealed. Cloudflare sits in front of this site and sees what any such service sees, which is network addresses and request timing.

What we collect

Nothing. There is no account to create, no email to give, no analytics in the apps, no third-party software development kits, no advertising identifiers, and no tracking across apps or sites. This site sets no cookies and loads no analytics. If you write to us, we have your email because you wrote.

Apple

The iPhone app is distributed through the App Store and TestFlight, and the Mac app is notarized by Apple. Apple's own services apply to those, including crash reports if you have chosen to share them with developers, and to iCloud Keychain and the iCloud zone above, under Apple's privacy policy.

Your choices

• Forget a secret or a sign-in on the phone, and it is gone from the vault and from every Mac's list.
• Erase this phone's vault, in Settings, and every secret, sign-in and the vault key in your iCloud Keychain are deleted. Deleting the app alone does not do this: the vault syncs so a new phone can recover it.
• Forget a Mac on the phone, or forget the phone on the Mac, and that pairing and its keys are gone.
• Turn the iCloud road off on the Mac and the apps speak only on your own network.
• The log is a file on your Mac. Delete it and it is deleted.
• Revoke Innkeeper in a provider's account settings and that provider stops answering it.

Children

Innkeeper is not directed at children under 13, and we do not knowingly collect anything from anyone, of any age.

Changes

If this page changes, the date at the top changes with it. Nothing here changes what the apps you already have do.

Contact

A2W, [email protected]. The person on the other end is [email protected].