Privacy Policy

This privacy policy explains which personal data is processed when you use the app ByoKey, for what purposes and on what legal basis, and which rights you have.

In short: the app does not send us any personal data. Anything you send through the app to one of the third-party services listed below goes directly from your device to that provider, not to us. We only receive data from you if you contact us yourself, for example by e-mail.

Last updated: 28 October 2026

This privacy policy only covers the app ByoKey. When you visit our website, the privacy policy of the website applies. If you open a page of this website from within the app – for example this privacy policy or the support page – it is loaded like any other visit to the website; the website’s privacy policy applies to that visit.

1. Controller

The controller responsible for processing personal data in connection with the app within the meaning of the EU General Data Protection Regulation (GDPR) is:

Maximilian Skibinski
Skibinski.dev - Maximilian Skibinski
Wladimir-Komarow-Straße 41
15517 Fürstenwalde/Spree
Germany

E-mail: hello@skibinski.dev

2. At a glance

• The app does not send us any personal data.
• Your content and settings are stored on your device.
• AI requests go directly from your device to the AI provider you choose (OpenRouter, Mistral AI, Scaleway, IONOS AI Model Hub, Vercel AI Gateway, Requesty, DeepInfra, Anthropic, Cerebras, DeepSeek, Google Gemini, Groq, OpenAI, Together AI and xAI). The provider processes them under your own contract with it, not on our behalf; we receive neither your input nor the answers. The app only sends data to a provider after you have explicitly allowed this in the app.
• In voice mode, recordings of your voice also go to the AI provider.
• The app stores your API key on your device and sends it only to the provider it belongs to – we never receive it.
• No analytics or crash reporting services are built into the app.
• No advertising.
• No tracking: the app does not track you across apps and websites of other companies.

3. Data on your device

Content and settings that you create or enter in the app are stored locally on your device, in the app’s protected storage area. We do not operate a server for this data and have no access to it.

Sensitive information such as passwords or access keys (for example API keys) is stored in the encrypted keychain of your device (iOS Keychain).

If you back up your device via iCloud or to a computer, the backup may also contain the app’s data. Whether and where this happens is up to you in your device settings; iCloud backups are subject to Apple’s terms and the Apple Privacy Policy. We have no access to these backups.

4. AI providers and your API key

The app’s AI features generate content with AI models of third-party providers. For this purpose, the app connects directly to the following services when you use these features:

• OpenRouter
• Mistral AI
• Scaleway
• IONOS AI Model Hub
• Vercel AI Gateway
• Requesty
• DeepInfra
• Anthropic
• Cerebras
• DeepSeek
• Google Gemini
• Groq
• OpenAI
• Together AI
• xAI

When you use an AI feature – for example by sending a message – the app transmits the data required for it in encrypted form (HTTPS) directly from your device to the provider you have selected in the app. Depending on the function, this includes your input, the conversation so far, files or images you attach, instructions for the model (such as a system prompt) and the selected model and its settings; for technical reasons, the provider also receives your IP address. The model’s answer returns the same way directly to your device.

In voice mode, the app also sends recordings of your voice to the provider so that it can convert them into text or answer them directly, as well as – for spoken answers – the text to be read aloud. Outside voice mode, the app does not send any recordings to the provider.

If the selected provider is an intermediary that routes requests to models from different developers, it forwards your request to a company that operates the selected model; you can find out from the provider which companies these may be.

The data does not pass through our servers, and we receive neither your input nor the answers – unless you send us some of it yourself, for example with a report. The provider is not our processor: it does not process the data on our behalf but under your own contract with it, its terms of use and its privacy policy. Whether and for how long it stores requests, whether it reviews them – for example to detect abuse – or uses them to train its models, and which settings you have for this, is explained there; please read them before using the service.

The app stores your API key on your device in the encrypted iOS Keychain. It sends the key only to the provider it belongs to, and only to authenticate your requests there. We do not receive your key and have no access to it. The key is bound to this device: it is not synchronised via iCloud Keychain and is not transferred to another device with a device backup.

Before the app sends data to a provider for the first time, it tells you the provider and the data that will be transmitted and explicitly asks for your permission. Without your permission, it sends nothing to that provider. You can withdraw your permission at any time in the app (Settings › Data sharing with AI providers); from then on, the app no longer sends any data to that provider. Data the provider has already received is subject to its own deletion rules; please contact the provider about it.

Data is only transmitted when you use the corresponding function. Insofar as the transmission is attributable to us, the legal basis is Art. 6(1)(b) GDPR (providing the function you requested).

One or more of the providers you can use with the app are based outside the EU/EEA or process data there. The European Commission has not found an adequate level of data protection for every country outside the EEA (for the USA, its decision only covers companies certified under the EU-U.S. Data Privacy Framework); where there is no such finding, your data may be less well protected, and it may be harder to enforce your rights. As the data goes directly to the provider you have chosen at your request, you decide where it goes by choosing the provider. Information on the provider’s location, processing locations and safeguards (such as a certification under the EU-U.S. Data Privacy Framework or EU standard contractual clauses) can be found in its privacy policy.

Think about which data you send to an AI provider. Avoid entering particularly sensitive information – such as health data, passwords or other credentials – and only enter personal data about other people if you are entitled to do so.

5. Access to device functions

The app may ask you for access to the following functions of your device. You decide whether to allow access and can change your decision at any time in your device settings (Settings › ByoKey).

• Photos – to select images or videos from your photo library or to save them there.
• Microphone – to record audio when you use voice input or a recording function. In voice mode, the recordings are sent to the AI provider (see above).
• Speech recognition – to convert your spoken input into text. Depending on the device, language and settings, the recording may be processed by Apple for this purpose.
• Notifications – to show you notifications that the app schedules on your device. No data is sent to us for this. You can switch notifications off at any time.

Data that the app obtains through these functions is used only for the respective function and as described in this privacy policy.

6. App Store

You obtain the app via Apple’s App Store. To download, install and update the app, Apple processes data such as your Apple Account and information about your device under its own responsibility; we have no influence on this. The Apple Privacy Policy applies.

If you have agreed in your device settings to share analytics data with app developers (Settings › Privacy & Security › Analytics & Improvements), Apple may provide us with crash reports and usage statistics in a form that does not identify you personally.

7. Contact by e-mail

If you contact us by e-mail – for example via the support page – we process your e-mail address, your message and any information you provide voluntarily (such as your device model or app version) in order to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to the use of the app, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests). We delete your request once it has been dealt with, unless statutory retention obligations apply.

8. Obligation to provide data

You are not legally or contractually obliged to provide personal data. However, individual functions cannot be used without the data required for them.

9. Additional information

Requests go directly from your device to the provider you chose; there is no server of ours in between. Some providers (OpenRouter, Vercel AI Gateway, Requesty) forward requests to the operator of the chosen model.

What is sent to a provider after your consent: the text of your messages, the text of files you attach (including the files you tick from ZIP archives and folders), images you attach (scaled down, as JPEG), the project instructions, the previous messages of the open chat, the model settings, your API key for that provider only and – in voice mode via the provider, after a separate consent – your voice recordings and the text to be read aloud. Your IP address is technically part of every connection.

Transfers outside the EU: for providers outside the EU or EEA, the consent screen explains the risks before you agree. Where no adequacy decision applies, the transfer is based on your explicit consent (Art. 49(1)(a) GDPR). You use each provider with your own account and key; the provider processes the data under its own terms and privacy policy.

Your own server: instead of a listed provider you can enter the address of your own server with an OpenAI-compatible interface, for example Ollama or LM Studio on your computer, also in your local network. Requests then go only to that server; its operator is whoever you choose. The app asks for your consent for that server as for any provider and withdraws it when you change the address.

Connect with OpenRouter: instead of entering a key, you can sign in to OpenRouter in the system sign-in window; the app does not see your password. OpenRouter creates a key in your OpenRouter account and returns a one-time code via a redirect page on our website (https://skibinski.dev/byokey/auth/openrouter), which passes it straight to the app without displaying or storing it. Like any page request, the request including the code may appear in the web server's log files. The code is useless without a value that only the app holds for this sign-in (PKCE).

Dictation and voice mode on the device: speech recognition runs on your device. Only if the system cannot recognise the selected language on the device and you have turned on “Allow Apple’s server recognition” in the settings, the recording is sent to Apple for recognition. A short tap on the waveform icon in the message field starts dictation with the same recognition; the recognised text is sent automatically after a speech pause, the same way as typed text. You set the pause under Settings › Voice and dictation › “Send after speech pause” (default: two seconds); with “Off”, nothing is sent until you tap the arrow.

Reports and feedback: if you report an answer or send us feedback, the app prepares an e-mail to support.byokey@skibinski.dev that you send from your own mail account. A report contains the reason, your optional description, the model ID, the time of the answer, the app version and an excerpt of up to 1,000 characters of the reported answer; feedback contains your text and the app and system versions. We also receive your sender address. We keep these e-mails until the matter is settled and then delete them unless a statutory retention obligation applies.

10. Storage period and deletion

• Data that the app stores on your device remains there until you delete it in the app or delete the app; deleting the app removes this data from your device.
• However, entries in the iOS Keychain may remain on the device even after the app has been deleted, until the device is reset.
• You can remove your API key in the app at any time. If you also revoke it with the provider, it becomes invalid – even if a copy still exists somewhere.
• We have no access to data you have sent to a third-party service; to have it deleted, please contact the respective provider directly.
• Otherwise, we delete personal data as soon as it is no longer needed for the purposes stated, unless statutory retention obligations require longer storage.

11. Your rights

As the app does not send us any personal data, we usually do not hold any data about you – apart from messages you send us.

You have the following rights regarding your personal data:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object (Art. 21 GDPR)
• right to withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR)

Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

The supervisory authority responsible for us is:
Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg)
Stahnsdorfer Damm 77
14532 Kleinmachnow
lda.brandenburg.de

To exercise your rights, an informal message to hello@skibinski.dev is sufficient. You can also use the form “Privacy request”.

12. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Children

As the app does not send us any personal data, we do not receive any data from children through it either. We do not knowingly collect personal data from children under 13 – or from children under 16 in the EU/EEA unless a parent or guardian has consented (Art. 8 GDPR). If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at hello@skibinski.dev; we will then delete this data.

14. Changes to this privacy policy

We will update this privacy policy if the app, the services used or the legal requirements change. The current version is always available on this page. This version is effective as of 28 October 2026.