Summary
- The Sealbreak app does not collect, sell, or share any personal data.
- The app connects only to the OpenBao or HashiCorp Vault endpoint you configure. There is no Sealbreak server or relay.
- Your unseal share stays in the iOS Keychain on your iPhone. It is released only after Face ID, and only to send it to your server.
- The app contains no analytics, advertising, tracking, or crash-reporting SDKs.
- The website sets no cookies and uses only cookie-free Cloudflare Web Analytics.
Who is responsible
Sealbreak is developed by Georges Alkhouri as an independent open-source project. For any privacy question, write to hello@sealbreak.app.
The Sealbreak app
Data stored on your iPhone
Sealbreak stores the following only on your device:
- Your Shamir unseal share. It is kept in the iOS Keychain, bound to this device, protected by Face ID, and excluded from iCloud Keychain sync. Sealbreak offers no way to export it.
- Server settings, such as the server name and HTTPS address you enter. They are stored in the app's protected storage and excluded from device backups.
None of this is sent to the developer. Deleting the app or resetting it in the app removes it from your iPhone.
Face ID
Face ID is handled entirely by iOS. Sealbreak only receives a yes or no from the system and never has access to your face data.
Clipboard
Sealbreak reads the clipboard only when you tap paste to import a share. After a valid share is pasted, Sealbreak clears the clipboard.
Network connections
Sealbreak connects only to the server address you configure, and only over HTTPS with normal certificate validation. It sends status requests and, after you approve with Face ID, your unseal share. This traffic goes directly from your iPhone to your server, or to a TLS proxy you run in front of it. The developer has no access to it.
Sealbreak does not use cookies, caches, or stored credentials for these connections. What your server logs is controlled by you, not by Sealbreak.
Analytics, tracking, and crash reports
The app contains no analytics, advertising, tracking, or crash-reporting SDKs, and it does not track you across apps or websites. Its App Store privacy manifest declares no tracking and no collected data types.
If you have turned on Share With App Developers in iOS settings, Apple may give the developer anonymous crash reports and usage statistics. This sharing is optional and governed by Apple's privacy policy. If you join the TestFlight beta, Apple's TestFlight terms apply to the feedback and crash reports you choose to send.
The sealbreak.app website
The website is a static site hosted by Cloudflare. It sets no cookies and loads no advertising or tracking scripts, fonts, or embeds. To count visits, it uses Cloudflare Web Analytics, which does not use cookies or local storage and does not track you across sites. It records anonymous page-load data such as the page visited, referrer, browser type, and country.
To deliver and protect the site, Cloudflare processes technical request data such as your IP address, browser user agent, and the page requested. Cloudflare may keep this data in short-lived logs. This processing is covered by Cloudflare's privacy policy. The developer does not use it to identify or profile visitors. Cloudflare may process this data in the United States and other countries outside the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which covers these transfers.
Links to GitHub, TestFlight, and the App Store lead to services with their own privacy policies.
When you contact us
If you email us or open a GitHub issue, we use what you send only to answer you and improve Sealbreak. Emails are not shared with third parties. GitHub issues are public and governed by GitHub's privacy statement. Please never include an unseal share, root token, or other secret in a message or issue.
Your rights
Because the app collects no data, the developer holds no app data about you. For any email you have sent, you can ask for access, correction, or deletion at hello@sealbreak.app. You may also lodge a complaint with your data protection authority.
Changes
If this policy changes, the updated version will be published on this page with a new effective date. The source of the app and this website is public, so you can check every change.
More detail on how Sealbreak protects your share is in the threat model and the source code.