Privacy Policy

1. Who we are

Ezkey is an independent software project led by Marc Gagnon (Pincourt, Québec, Canada). It produces the Ezkey Android mobile app, available on Google Play, and the ezkey.org website. The project is in active development.

Privacy inquiries: privacy@ezkey.org — General: support@ezkey.org

2. The two-layer model — what Ezkey is and is not

Layer 1 — Ezkey the project (this policy). The Ezkey project publishes software. It operates no cloud service, no authentication server, and no central database. It has no visibility into your usage of the app.

Layer 2 — Your organization’s self-hosted backend. To use Ezkey, you enroll with an organization that runs its own Ezkey backend server on its own infrastructure. That organization is the data controller for any personal data processed on their server. You should consult their privacy policy for information about how they handle your data.

This policy covers only the Ezkey mobile app and the ezkey.org website. It does not cover any organization’s self-hosted Ezkey backend.

3. Data stored on your device

The Ezkey app stores the following data locally on your device only:

• Cryptographic key pairs — Generated on enrollment and stored in the Android Keystore (hardware-backed when available). Never transmitted off your device; used only to sign authentication challenges.
• Enrollment metadata — The name and URL of each organization you have enrolled with, and the enrollment display name assigned by your organization’s administrator. This information is stored in the device’s secure credential storage.
• Pending authentication state — Temporary data held in memory while you are responding to an authentication challenge. This may include contextual information provided by your organization’s backend about the action to approve (e.g. a title such as “Document Signature Request” and a message describing the specific action). This data originates from your organization, not from the Ezkey project, and is not retained after the session completes.

Uninstalling the app removes all of the above data from your device. Any record of your enrollment on your organization’s backend remains subject to their own data retention policy.

4. Data sent over the network

The app communicates exclusively with the backend URL obtained from the QR code you scan during enrollment. That URL is the endpoint of your organization’s self-hosted Ezkey server. The app sends:

• During enrollment (verify step): the device public key (EC P-256), a cryptographic signature proving possession of the corresponding private key, and a device security capability label indicating the hardware protection tier of the key storage (e.g. STANDARD or STRONG), as reported by the device.
• During each authentication poll: a stable enrollment identifier and a freshly generated signed one-time device proof token — together identifying the enrollment and proving device participation for that specific request.
• When approving or denying: the decision (approved or denied) and a cryptographic signature over it. No personal or contextual data originates from the device.

The app also receives data from your organization’s server. When a contextual approval request is initiated by your organization, the pending response may include a title and message describing the action to approve (for example: “Document Signature Request — Please approve the signing of the NDA with partner Acme Corp.”). This data originates from your organization’s backend, is displayed to you after the app verifies its cryptographic signature, and is not stored beyond the authentication session. The Ezkey project has no visibility into this content.

No data is sent to any server operated by the Ezkey project.

No analytics, crash reports, telemetry, or advertising data is transmitted by the app.

5. Android permissions

6. Third-party SDKs and services

The Ezkey app does not integrate any SDK that collects user data, including but not limited to advertising SDKs, analytics SDKs (Firebase Analytics, Mixpanel, etc.), or crash-reporting SDKs (Crashlytics, Sentry, etc.).

The app uses the following open-source libraries for their stated technical purpose:

• React Native — UI framework
• react-native-vision-camera — camera access for QR scanning
• react-native-keychain — secure credential storage
• Conscrypt (Android) — cryptographic primitives (Ed25519)
• MLKit Barcode Scanning (on-device) — QR decoding without network calls
• axios — HTTP client used exclusively to communicate with your organization’s self-hosted backend; transmits no data to third parties
• AsyncStorage — on-device persistent storage used for enrollment metadata; data never leaves the device

None of these libraries transmit data to their authors or any third party.

7. The ezkey.org website

The ezkey.org website is a static site hosted on Cloudflare Pages. It does not use cookies, does not set tracking pixels, and does not load third-party analytics scripts.

Cloudflare may collect standard web server logs (IP address, user agent, timestamp) for security and infrastructure purposes, subject to Cloudflare’s privacy policy. The Ezkey project does not receive or process those logs.

8. Children

The Ezkey app is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are under 13, please do not use the app.

9. Your rights

Data on your device

You can delete all data stored by the app at any time by uninstalling it from your device. Android’s “Clear data” function in App Settings achieves the same result without uninstalling.

Data on your organization’s backend

Any enrollment record or authentication history held by your organization’s Ezkey backend is subject to that organization’s own data retention and deletion policies. Please contact your organization’s administrator to exercise your rights (access, rectification, erasure, portability) regarding that data.

Quebec residents (Act respecting the protection of personal information — Law 25)

As the Ezkey project does not collect personal information, there is no personal information held by us to access, correct, or delete. If you have questions or concerns, contact us at privacy@ezkey.org.

EU residents (GDPR)

As the Ezkey project does not act as a data controller or processor of personal data (it operates no servers and receives no user data), GDPR controller obligations do not apply to the project. Your organization’s self-hosted backend is the relevant controller. For personal data held by Cloudflare (web server logs), refer to Cloudflare’s GDPR documentation.

10. Data security

Cryptographic keys generated by the app are stored in the Android Keystore, which provides hardware-backed protection on supported devices. Network communication with your organization’s backend uses HTTPS. The Ezkey project recommends that organizations configure their backend with a valid TLS certificate.

11. Changes to this policy

We may update this policy as the project evolves. Significant changes will be noted in the table below. The current version is always available at https://ezkey.org/privacy.html.