Privacy

What Innkeeper holds, and what it does not

This covers the Innkeeper app for iPhone, the Innkeeper app for Mac, the relay at relay.a2w.io, and this site. All of them are made by A2W. Effective 3 September 2026.

The short version: your phone holds the secrets, your Mac holds nothing at rest, the relay between them carries sealed envelopes it cannot open, and we run no accounts, no analytics and no tracking. Nothing about you is collected by us.

What the iPhone app holds

A signing key made in the Secure Enclave, which never leaves the phone. The credentials you add, in the phone's keychain. The Macs you have paired: their names, addresses and keys, and a secret agreed at pairing. Ten recovery codes, shown to you once; the Mac keeps only their hashes. None of it is sent to us. A credential leaves the phone only when you approve a call that spends it, sealed to the one Mac that asked, for one use.

What the Mac app holds

No credentials at rest. When you approve a call, the Mac holds the credential in memory for a measured number of seconds, hands it to exactly one caller, and overwrites it. It keeps a log on your Mac of who asked, for what, when, and how long you took, with names and verdicts and never a value. It keeps your phone's push token, so it can ring your phone through Apple. All of this stays on your Mac.

What travels, and who can see it

At home, requests and answers go between your phone and your Mac over your own network, sealed to keys the two agreed at pairing. When your phone is elsewhere, the same sealed envelopes travel through our relay. The relay keeps no accounts. It can see a Mac's key fingerprint, the size bucket of each envelope, when envelopes pass, and the network addresses they come from. It counts them and keeps no other record. It holds an envelope until the other side collects it, for a few hours at most, as sealed bytes it cannot read or forge, in memory or in a hosted queue store. You can point the apps at a relay of your own, or turn the relay off and use your own network only.

Push notifications go through Apple's push service. A notification says that an approval is waiting and nothing else; the request itself is fetched by the app, sealed. Cloudflare sits in front of this site and the relay and sees what any such service sees, which is network addresses and request timing.

What we collect

Nothing. There is no account to create, no email to give, no analytics in the apps, no third-party software development kits, no advertising identifiers, and no tracking across apps or sites. This site sets no cookies and loads no analytics. If you write to us, we have your email because you wrote.

Apple

The iPhone app is distributed through the App Store and TestFlight, and the Mac app is notarized by Apple. Apple's own services apply to those, including crash reports if you have chosen to share them with developers, under Apple's privacy policy.

Your choices

• Forget a Mac on the phone, or forget the phone on the Mac, and that pairing and its keys are gone.
• Turn the relay off on the Mac and the apps speak only on your own network.
• The log is a file on your Mac. Delete it and it is deleted.
• Delete the app and everything it held goes with it. Recovery codes stop working with it.

Children

Innkeeper is not directed at children under 13, and we do not knowingly collect anything from anyone, of any age.

Changes

If this page changes, the date at the top changes with it. Nothing here changes what the apps you already have do.

Contact

A2W, [email protected]. The person on the other end is [email protected].