Privacy policy

This policy covers every MimiKey product: the iOS, Android, Mac and Windows apps, the browser extension, the web app (password.tminos.com) and the website (mimikey.com).

• Operator: Hangzhou Teminuosi Artificial Intelligence Technology Co., Ltd. (杭州特米诺思人工智能科技有限公司, "we")
• Address: Room 208-A3980, Building 2, No. 138 Dinggong Road, Liangzhu Subdistrict, Yuhang District, Hangzhou, Zhejiang, China
• Contact: hanfeihu@tminos.com

Effective date: November 6, 2026

#In one sentence

Everything you keep in MimiKey — passwords, passkeys, one-time code secrets and other items — is encrypted on your device before it is uploaded. The master password and Secret Key needed to decrypt it never leave your devices. We cannot see your items and cannot decrypt them for you.

#What we collect

#1. Account information

#2. Encrypted vault data

• Item ciphertext, revision numbers and modification times; each vault's change log (ciphertext only).
• Each device you register: device name, device public key, registration time, revoked status.
• Shared vaults: vault name, membership and permissions, and the vault key wrapped for each member (ciphertext).
• Your account identity public key, and the identity private key sealed with your identity material (we cannot unseal it).

This ciphertext cannot be opened without your master password and Secret Key. We can still observe some metadata: item counts, ciphertext sizes, modification times, and the timeline of devices and requests.

#3. Third-party authorization

When you allow another app to read or save an item through MimiKey, we store: the app's registration details, your grant, hashes of tokens and authorization codes, request metadata provided by the app (the stated reason, URL and title hints, names of fields to change) and the sealed result. Only that app's grant can open the result; we never see the plaintext.

For "machine" access tokens such as those used by AI assistants, we store only the name and a hash.

#4. Paid orders

MimiKey is currently free. If we offer paid plans in the future, we will store the plan, amount, payment-channel order number and payment time to activate your plan and reconcile payments. Card and payment-account details are handled by the payment channel; we never receive or store them.

#5. Access logs

Our servers automatically keep access logs: IP address, time, requested URL and browser or client identifier. Logs are used only for security, troubleshooting and abuse prevention, and are deleted after at most 180 days.

#What we do not collect

• Your master password, Secret Key, or any key that can decrypt your items.
• Item plaintext: usernames, passwords, URLs, notes, passkey private keys, one-time code secrets.
• Face ID, Touch ID, fingerprint or other biometric data. Biometric checks are performed by the operating system; we only learn whether the check passed.
• Contacts, photos, location or clipboard history.
• We do not include any third-party advertising, analytics or crash-reporting SDKs, and we do not track you across apps or websites.

#Information processed only on your device

• AutoFill: AutoFill on iOS, Android and Mac, and the browser extension, read the current page's URL and login form, or the current app's identifier, on your device to match and fill items. This information is not uploaded.
• Browser extension and desktop app: the extension talks to the desktop app through the operating system's native messaging channel, not through our servers.
• Clipboard: passwords copied on iOS and Android are cleared from the clipboard after a short time; on iOS they are also not synced to your other Apple devices through Universal Clipboard.

#Where data is stored

Our servers are located in the People's Republic of China (Alibaba Cloud, Hangzhou). If you use MimiKey outside China, your data is transferred to and processed in China.

#Who we share it with

We do not sell your personal information or share it for advertising or marketing. Third parties are involved only as follows:

We also disclose information when required by law or by a lawful request from a competent authority. Because of end-to-end encryption, all we can provide is the account information and ciphertext listed above.

#How long we keep it

• Account information and encrypted data: until you close your account.
• Access logs: up to 180 days.
• Order records: for the period required by accounting law.
• After you close your account, we delete or anonymize your account information and all encrypted data within 15 working days, unless the law requires otherwise.

#Your rights

• View and export: view all items in the app at any time and export them (Bitwarden, KeePass and other formats).
• Correct: edit items and device names in the app; change your master password in account settings.
• Revoke devices and grants: revoke a device in the device list, or an app under third-party authorization.
• Close your account: email hanfeihu@tminos.com from your registered address and ask us to close it. After verifying your identity we close the account and delete your data within 15 working days. Deleted data cannot be recovered.
• Other requests: for any question or complaint about this policy or your personal information, email us; we reply within 15 working days.

#Security

• Items are protected with end-to-end encryption on your devices; the server stores ciphertext only.
• Sign-in uses the SRP protocol; the server never receives your master password.
• All network traffic is encrypted with TLS.
• Tokens, authorization codes and verification codes are stored as hashes only.
• See the security model and encryption details.

If a personal-information security incident occurs, we will notify you and report to the authorities as required by law.

#Children

MimiKey is intended for adults. Children under 14 should use it only with the consent and guidance of a parent or guardian.

#Changes

When we update this policy we change the effective date above; for material changes we will show a clear notice in the apps or on the website.