Privacy Policy

What we never collect

Kleopatra performs all encryption, decryption, signing, verification, and key generation locally, in your browser, using the open-source OpenPGP.js library. Your keys are stored only in your browser’s localStorage and are never transmitted anywhere. The following data never leaves your device and is never sent to us or to any third party:

• Your private keys or passphrases
• Public keys you import or generate
• Any message you type, paste, encrypt, or sign
• Encrypted (armored) ciphertext
• Decrypted or verified message content
• Key fingerprints or key IDs

What we do collect

To understand which tools are useful and to fix problems, we use PostHog, an open-source, privacy-focused analytics platform. All collection is anonymous — there are no accounts and we do not build advertising profiles. We collect:

• Anonymous page views (which tool or guide you opened)
• Aggregate feature usage (e.g. “encrypt” was clicked)
• Browser and device type, and approximate country
• Session recordings with every input and text masked

Our session recordings exist to diagnose usability issues, not to read your content. Every input, textarea, and text node is masked before anything is recorded — pasted keys, typed messages, ciphertext, decrypted output, and fingerprints all appear as censored placeholders. We technically cannot see them.

Where your data is stored (EU)

All analytics data is stored in the European Union. Events are sent first-party through kleopatra.app/posthog-gpdr and proxied to PostHog’s EU region (eu.posthog.com). Data never crosses to a non-EU server, in line with RGPD data-residency requirements.

Your rights under the RGPD / GDPR

Because we never collect personal or sensitive data and do not create user accounts, the data we hold is anonymous usage statistics. You still have the right to access, rectify, or request erasure of any data relating to you, and to object to processing. You can also disable analytics entirely by using your browser’s “Do Not Track” setting or any content blocker — the app works exactly the same without it.

Local storage & cookies

Your PGP keys are kept in your browser’s localStorage so they persist between visits; they are never uploaded. PostHog stores an anonymous identifier to avoid counting the same visitor twice. It contains no personal information and is never linked to your keys or messages.

Contact

Questions about this policy or your data? Kleopatra is free and open-source — you can audit exactly what runs in your browser on GitHub, or reach the community on Discord.