BABEL TOKENBABEL TOKEN Privacy Policy
1. Summary
We collect no personal data. BABEL TOKEN runs entirely on your device, has no networking capability, and contains no analytics, advertising, crash reporting or third-party tracking components. The App Store privacy label for this app reads "Data Not Collected", and that is literally the case.
2. What we collect
Nothing. BABEL TOKEN transmits no data to MNV LIMITED — not your keys, not the names of the services you use, not usage patterns, not device identifiers, not diagnostics. The app contains no networking code, so it could not do so even by mistake.
3. Where your data is stored
3.1 Everything you enter is stored in a local database on your device. Secret values, notes, rotation history and the trash are encrypted with AES-256-GCM. Names, providers, tags, environments and dates are stored without encryption so that the list, search and expiry reminders work without unlocking. The database is additionally covered by iOS data protection.
3.2 The data key that encrypts your secrets is stored in the iOS Keychain, in an access group private to this app and its share extension. Whether it is included in device backups is controlled by iOS and by the app's strict-mode setting (see the Terms of Use, Section 4).
3.3 Backup files you export are stored wherever you choose to put them (the Files app, iCloud Drive, AirDrop, or any destination you share to), and may optionally be encrypted with a password of your choosing. Privacy and security at those destinations are governed by those providers' terms and are outside our control.
4. Clipboard
4.1 Copying a key places it on the system clipboard with an expiry, after which iOS clears it (60 seconds by default, 30 seconds in "this iPhone only" mode).
4.2 Universal Clipboard is a feature of iOS, not of this app. With Handoff enabled in iOS Settings, the clipboard can follow you to your other Apple devices signed in to the same Apple Account, over Apple's own device-to-device channel. The app lets you choose whether copied keys may take part in it. No copy passes through MNV LIMITED.
4.3 When the app returns to the foreground it checks whether the clipboard contains text, so that it can offer a paste shortcut. It does not read the contents until you tap paste.
5. Share extension
The BABEL TOKEN share extension processes the text or file you share entirely on your device and writes it into the same local vault. Nothing is transmitted anywhere.
6. Permissions
6.1 Face ID / Touch ID — used only to unlock secrets on this device. Biometric data is managed by iOS; BABEL TOKEN never touches and cannot read it.
6.2 Files — only the files you pick when importing or exporting.
6.3 The app requests no camera, microphone, location, contacts, photo library or notification permission.
7. About our website
Everything above is about the application. www.babeltoken.com is a separate thing: like any web server it may keep standard access logs (IP address, page requested, time, browser user-agent), used only to keep the site running and to investigate faults. The application never contacts the website; no data passes between them.
8. Apple's role
When you download the app through the App Store, Apple may collect data under its own privacy policy. That is outside our control and unrelated to the application itself.
9. Children
BABEL TOKEN is a developer tool and is not directed at children under 13. We collect no data from anyone, children included.
10. Your rights
10.1 Because we hold none of your data, requests under privacy laws to access, correct, delete, port or opt out of sale cannot be actioned by us — not as a refusal, but because there is genuinely nothing on our side.
10.2 You can delete individual keys, empty the trash, or erase all data in the app at any time; deleting the app removes everything from your device, including the local database. Confirm you have a backup first.
11. Legal position
11.1 For the purposes of the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), MNV LIMITED is not a "data user" in respect of your vault data, because that data never leaves your device and is never held or controlled by us.
11.2 For the same reason we are neither a "controller" nor a "processor" under the GDPR, nor a "business" or "service provider" under US state privacy laws such as the CCPA/CPRA.
12. Changes
Updates to this policy will be published in the application and at www.babeltoken.com, and material changes will require your acceptance again.
13. Contact
MNV LIMITED (incorporated in the Hong Kong Special Administrative Region)
Business Registration No. 74044496
support@babeltoken.com
www.babeltoken.com
This text is identical to the version shown inside the app under Me › About.