What Strongbox for iOS sends to RevenueCat and Superwall
Document changes
Two documents of Strongbox that changed while file 0001 was prepared: each version in full, the words added in the later version underlined.
Two of Strongbox's documents changed after the authors sent their questions: the privacy policy and the support article on network connections. This page prints both versions of each in full, the version in force during the study first, then the version after the change. The earlier texts are taken from Wayback Machine snapshots of 1 October 2026 and match the PDF copies of 8 October 2026; the later texts were taken from the vendor's pages on 16 October 2026; for the policy, the Wayback Machine snapshot of that day gives the same text, while for the article the archive resolves the address to its copy of 9 June 2026, so the text of 16 October 2026 rests on the authors' copy (PDF and text file).
How the differences are marked
Each earlier version is printed as plain text, without marks. In each later version, Added: underlined words are not in the earlier one. The marks are made automatically, word by word, from the two text files as served among the files on record. Differences of spacing, line breaks, list numbering and quotation-mark style are not marked; a shared run of fewer than three words between two changes is marked as changed.
Strongbox: Privacy Policy
Published at strongboxsafe.com/privacy/. The page dates the new version “Last Update: 15 October 2026”.
Earlier version “Last Update: 9 May 2024”
- Status
- In force during the study; the report's reference state (8 Oct 2026).
- Text shown
- D1_privacy-policy_strongboxsafe.com_wayback-20261001190802.txt; the page text from the raw Wayback Machine snapshot, main content only, link text without addresses. The snapshot of 8 Oct 2026, 21:29 CEST (19:29 UTC), gives the same text.
- PDF copy
- D1_privacy-policy_strongboxsafe.com_2026-10-08.pdf, saved
- Wayback Machine
- snapshot of 1 Oct 2026, 21:08 CEST (19:08 UTC)
https://web.archive.org/web/20261001190802/https://strongboxsafe.com/privacy/
Our Privacy Policy
Last Update: 9 May 2024 – Added information on GDPR Compliance, improved formatting/readability.
Previous Update: 29 September 2021 – Added reference to “Strongbox Zero”
This privacy policy governs your use of the software application Strongbox (“Application”), the Strongbox website (“Website”) located at https://strongboxsafe.com and your interaction with the UK based company Phoebe Code Limited (“Company”). We endeavour to have this privacy policy be the central location for all privacy related issues and be the single source of truth.
Summary
The Application is a client side application for iOS and MacOS. It cannot physically store any of your information outside of your device and as soon as you delete the Application all information is also erased from your device. You may use the Application to store your encrypted databases outside of your device using built in integrations provided by the Application or otherwise via built in OS support. The Company does not collect any of your data and operates a zero knowledge policy when it comes to your data. This also means we cannot reset your password nor tell you what it is for recovery purposes. This is by design.
What information does the Application obtain and how is it used?
The Application does not store any information and only collects the absolute bare minimum required for functionality. None of this information is used by the Application, Website or Company for advertising or other marketing purposes. You may enter information into your password databases, this is encrypted on device and is never sent in plaintext anywhere. If you choose to use one of the cloud storage/server integrations, this encrypted database will be transmitted to your chosen and configured cloud storage provider.
How do you handle location data?
The Application does not use or collect any data related to your geographic location.
Can users see their personal data?
The Application itself does not collect any user data. To see their data users can unlock their password databases using their master credentials – known only to them.
Do you share personal information?
No, we do not have your personal information to share with anyone. If you choose to use the FavIcon Downloader Strongbox uses the URL of your entry to try to find the best FavIcon for it, using various services. These include directly downloading of well known favicon files (e.g. favicon.ico), the DuckDuckGo favicon service, and Google’s favicon service. This FavIcon downloader is an opt in feature and using the various services to find the best favicon is configurable.
What possible Network Connections can the Application make?
Network connections are covered in the Support article here. The obvious cases are to connect to your remote storage provider to sync (read & write) your database. This could be any of the native integrations with iCloud, Google Drive, Dropbox, OneDrive but also via the iOS Files app with any third party integration you might use to connect to your favourite cloud (e.g. Sync, Nextcloud, Box, etc). The Application also provides support for WebDAV/SFTP so that you can connect to your own private server or use a cloud hosted one (e.g. Nextcloud, Owncloud). Data will be transmitted to authenticate and to read/write your database from your selected cloud service. All of this is opt in and you can always use local databases instead if you prefer.
Do you offer any alternative, more privacy conscious products?
We now offer Strongbox Zero, a custom built stripped-down application for the super privacy conscious individual. You can find it here on the App Store.
Do advertising companies collect data?
The Application does not collect or maintain user data for any purposes (advertising or otherwise).
Do you use vendors or analytics providers?
The Application does not use vendors or analytics providers. The Website uses Plausible (an ethical and privacy conscious analytics provider) to track standard visit statistics and page performance. Plausible does not use any cookies. We do not use this data for advertising or marketing purposes.
What about my Cloud Storage Providers? Do they have my data?
Unencrypted data like your passwords etc never leave your device. Only encrypted password databases are transmitted to your storage provider of choice and so they cannot have access to your passwords or other sensitive data. The Application, Website and Company do not store any of your information. See the following help article for more information.
How do you store or manage support and or other correspondence emails?
Any data that you send in your correspondence with support or other emails regarding the Application, Website or Company. Support email hosting is provided by Google Workspace, business email by Microsoft Office 365. These mailboxes are regularly purged/expunged. We also use the third party service Re:Amaze to manage Helpdesk issues submitted via the Website and/or via support email.
Do you comply with the EU’s GDPR?
Yes, Strongbox is an offline-first, open-source application and user data is stored locally or on cloud drives or servers belonging to the user, and not shared with any third parties or Phoebe Code Limited. This means it inherently supports GDPR compliance. We don’t run any servers, have access to any of your data, nor do we store any of your data. We’re also very keen to keep it that way.
Do you comply with the Children’s Online Privacy Protection Act (COPPA)?
Yes. We do not solicit nor gather any data from children under the age of 13. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us.
How to contact us
If you have any questions about The Application, Website or Company’s privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.
Later version “Last Update: 15 October 2026”
- Status
- Published after the authors' questions; accessed 16 Oct 2026.
- Text shown
- D1_privacy-policy_strongboxsafe.com_2026-10-16.txt; the page text taken from the vendor's page on 16 Oct 2026, about 18:20 CEST (16:20 UTC), main content only, link text without addresses; the Wayback Machine snapshot below gives the same text.
- PDF copy
- D1_privacy-policy_strongboxsafe.com_2026-10-16.pdf, saved
- Wayback Machine
- snapshot of 16 Oct 2026, 19:16 CEST (17:16 UTC)
https://web.archive.org/web/20261016171629/https://strongboxsafe.com/privacy/
Our Privacy Policy
Last Update: Added: 15 October 2026 – Updated information on purchases, service providers, analytics, crash reporting and optional integrations.
Added: Previous Update: 9 May 2024 – Added information on GDPR Compliance, improved formatting/readability.
Added: Who we are
Added: This policy explains how personal information is processed when you use Strongbox, our website at https://strongboxsafe.com, or contact our support team.
Added: Strongbox is provided by Phoebe Code Limited, based in the UK. Contact us through the Strongbox support page with privacy questions or requests.
Added: Your password databases
Added: Strongbox encrypts your password databases on your device and Added: decrypts them locally when you unlock them. We cannot reset your database master password or decrypt your database without its required credentials.
Added: You can store databases locally or use a supported cloud service, WebDAV or SFTP. Storage integrations authenticate with your selected provider and transmit your encrypted database to it. Strongbox Sync uses Apple’s CloudKit infrastructure.
Added: AutoFill passes the credentials you choose to the relevant website or app. You can also choose to copy, share or export database contents.
Added: If you enable optional integrations such as MCP access for an AI application, that application can receive the information you authorise Strongbox to disclose. Information returned to an AI application may be processed by its model provider, depending on the application’s configuration and privacy policy. Strongbox’s local connection does not control what the receiving application does with that information.
Added: Database encryption is separate from the purchase, analytics, diagnostic and support processing described below. Using local storage does not by itself disable those services.
Added: Purchases and subscription management
Added: We use Apple and RevenueCat to manage purchases and subscriptions, check access to paid features, restore purchases and determine offer eligibility. RevenueCat also provides purchase and subscription reporting.
Added: Strongbox does not require a Strongbox account, and we do not Added: supply RevenueCat or Superwall with a custom Strongbox account identifier. These services use SDK-generated identifiers and may process device identifiers to associate purchase status and related events with an installation or device. The absence of a Strongbox account does not make this information anonymous.
Added: The iOS freemium app also uses RevenueCat for Apple Ads attribution, associating installations and purchases with advertising campaigns.
Added: See RevenueCat’s privacy policy.
Added: If you activate Strongbox through Setapp, Setapp also processes activation and subscription information under its privacy policy.
Added: Upgrade screens and related analytics
Added: The iOS freemium app uses Superwall to provide upgrade screens, manage offers and measure their performance. This integration can run even when you already have an active Pro subscription.
Added: Superwall processes technical information, app-usage events and purchase status for these purposes. It may derive approximate location from your IP address and estimate the likelihood of a purchase. This is not GPS location tracking.
Added: Upgrade screens may load resources from Superwall and third-party hosts. The crash-reporting switch does not disable Superwall or RevenueCat.
Added: See Superwall’s privacy policy.
Added: Crash reporting
Added: The iOS app uses Sentry to diagnose crashes using technical reports. Crash reporting is enabled by default on a fresh installation and can be turned off in settings. When disabled, Strongbox does not start Sentry, or closes it if it is already running.
Added: Crash reporting is intended to diagnose software failures, not collect password-database contents.
Added: See Sentry’s privacy policy.
Added: Favicon downloading
Added: If you enable favicon downloading, Strongbox uses an entry’s website address to find an icon. Depending on your settings, it contacts the website itself, DuckDuckGo or Google’s favicon service. Those services receive the requested website address or domain and connection information.
Added: Website and support
Added: Our website uses Plausible for visit statistics and page performance. Plausible does not use Added: cookies, and we do not use Added: these website statistics for advertising or Added: marketing.
Added: When you contact support, we use the information you provide to investigate and respond. We use Freshdesk to manage requests and email services to handle correspondence. These services store the messages and attachments you send us.
Added: Retention and deletion
Added: You control databases and backups stored locally or Added: with your chosen storage provider. Uninstalling Strongbox does not necessarily delete those files or purchase, analytics, diagnostic and support records held by service providers. Contact us to request deletion of information processed under our responsibility.
Added: Your rights
Added: Depending on applicable law, you may have rights to access, correct, erase or receive a copy of personal information, restrict or object to processing, and withdraw consent where processing relies on it. Some information may need to be retained to meet legal obligations.
Added: Contact us through the Strongbox support page to exercise your rights. We may need to verify your request and locate the relevant records. You can also complain to the UK Information Commissioner’s Office or your local data-protection authority.
Added: Strongbox Zero
Added: We also offer Strongbox Zero, a separate, custom-built, stripped-down edition for privacy-conscious users. Find Strongbox Zero on the App Store.
Added: Different editions and changes
Added: The services used differ between iOS, macOS and Strongbox Zero, and between freemium and outright Pro editions.
Added: We will update this policy when our processing changes and communicate significant changes through an appropriate user-facing channel.
Strongbox: What Network Connections Can Strongbox Make?
Published at strongbox.reamaze.com/kb/security-and-privacy/what-possible-network-connections-can-strongbox-make (also shown inside strongboxsafe.com/support/). The article carries no date. Last records of the old version: Wayback Machine, 1 October 2026, and PDF, 8 October 2026; first record of the new version: 16 October 2026. Authors' account: on 14 October 2026 the article was still unchanged (checked without a record), so it changed between 14 and 16 October 2026.
Earlier version version of 8 Oct 2026
- Status
- In force during the study; the report's reference state (8 Oct 2026).
- Text shown
- D4-D8_network-connections_reamaze_wayback-20261001191012.txt; the article text from the raw Wayback Machine snapshot, link text without addresses; list numbers and dashes, with an indent of three spaces for each level, stand for the page's HTML lists.
- PDF copy
- D4-D8_network-connections_reamaze_2026-10-08.pdf, saved
- Wayback Machine
- snapshot of 1 Oct 2026, 21:10 CEST (19:10 UTC); made when the support page was archived (snapshot of 1 Oct 2026, 21:10 CEST (19:10 UTC)), at the address the page uses to show the article; the snapshot of the article's direct address of 9 Jun 2026, 12:29 UTC, gives the same text
https://web.archive.org/web/20261001191012/https://strongbox.reamaze.com/kb/security-and-privacy/what-possible-network-connections-can-strongbox-make?sso%5Bid%5D=&sso%5Banon_id%5D=&sso%5Bfirst_seen%5D=2026-10-01T19%3A10%3A12.738Z&sso%5Bname%5D=&sso%5Bavatar%5D=&sso%5Bemail%5D=&sso%5Bauthkey%5D=&sso%5Bauthpath%5D=&sso%5Bparent_url%5D=https%3A%2F%2Fstrongboxsafe.com%2Fsupport%2F%23reamaze%230%23%2Fkb%2Fsecurity-and-privacy%2Fwhat-possible-network-connections-can-strongbox-make&sso%5Btz_offset%5D=0&sso%5Btz_name%5D=Etc%2FUnknown&framed=1&no_subject=0&require_attachment=0&form_id=&category_id=
What Network Connections Can Strongbox Make?
The following are the possible network connections that Strongbox can make which may be seen if you monitor network traffic while using the features described below.
1. Apple App Store (Mandatory)
1. Strongbox makes requests to Apple for two reasons.
- In App Purchase pricing and purchase/restore transactions
- This call is made to Apple’s App Store via the standard StoreKit API to determine:
- What upgrade options are available and their pricing.
- What Tips (users can leave tips to support us at their discretion) are available and their pricing
- App Store Receipt download and refresh. Strongbox verifies the App is legitimately purchased from the App Store. To do this Strongbox checks the receipt. This is something every App from the App Store has. This needs to be refreshed at times to verify legitimate purchases/subscription status. This is to make sure the App is not side-loaded, jail-broken or otherwise hacked and is entitled to be run on the device in question. Source code for that can be found here.
2. Offline Connectivity Detection - (On by default, opt out in preferences)
- Strongbox tries to determine if you go offline so that it can offer you the option of using its local version instead
- This offline detection works by trying to see if it can connect to https://duckduckgo.com. No information is sent, just a connection test.
- Source code for that is found here.
- This can be turned off in Advanced Preferences.
3. FavIcon Download - (Opt In)
- If you have the ‘Auto Fetch FavIcon’ preference (Database Preferences > View Preferences > Details View) or if you choose ‘Download FavIcon’ from the Change Icon screen, Strongbox will attempt to determine the best FavIcon(s) for you (based on the entry URL) and set the icon on your entry accordingly.
4. ‘Have I Been Pwned?’ Security Audit - (Opt-In)
- If you choose to enable the ‘Have I Been Pwned?’ security audit Strongbox will at appropriate times try to determine if your passwords are compromised or insecure. You can read much more about this audit here. This endpoint for this service is https://api.pwnedpasswords.com
NB: This is of course apart from the built-in cloud storage options (Strongbox Sync, iCloud, Dropbox, Google Drive, OneDrive, WebDAV, SFTP, Wi-Fi Sync) whose entire purpose is to go out on the network to read and write your database.
NB: Before using Google Drive, Dropbox or OneDrive Strongbox presents a warning about using third party storage providers whose privacy policies may be less than ideal.
NB: None of these connections send any of your databases or personal identifying information.
How can I verify this?
For your own verification purposes you can use Wireshark, Charles or Surge to monitor all network traffic and the steps to do so are described here:
https://stackoverflow.com/questions/3924633/how-can-i-debug-network-requests-from-my-iphone
Strongbox Zero
We also offer an alternative version of the app with much of the networking code stripped out. Check out Strongbox Zero.
Later version version of 16 Oct 2026
- Status
- Rewritten after the authors' questions; accessed 16 Oct 2026.
- Text shown
- D4-D8_network-connections_reamaze_2026-10-16.txt; the article text taken from the vendor's page on 16 Oct 2026, about 18:20 CEST (16:20 UTC), link text without addresses; a Wayback Machine capture requested the same day resolves to the archive's copy of 9 Jun 2026, the old version.
- PDF copy
- D4-D8_network-connections_reamaze_2026-10-16.pdf, saved
What Network Connections Can Strongbox Make?
Strongbox can make Added: network connections for database synchronisation, purchases, upgrade screens, crash reporting and optional features.
Added: The connections depend on your platform, edition, settings and the features you use. Storing your database locally does not, by itself, disable purchase, upgrade-screen or diagnostic services.
Added: Database storage and synchronisation
Added: If you choose a remote storage location, Strongbox connects to that service to authenticate and read or write your encrypted database.
Added: Supported options include Strongbox Sync, iCloud, Dropbox, Google Drive, OneDrive, WebDAV and SFTP. When you access a database through Apple's Files app or a folder managed by another application, that application may handle the network connection instead.
Added: Strongbox Sync uses Apple's CloudKit infrastructure. Wi-Fi Sync communicates between your devices over your local network.
Added: Your database is transferred in its encrypted file format. Your master password is not sent to your storage provider to decrypt it.
Added: Purchases and subscriptions
Added: Strongbox communicates with Apple's App Store Added: to retrieve products and prices, process purchases, restore purchases and check purchase status.
Added: Applicable editions also use RevenueCat to manage purchase and subscription status. RevenueCat processes purchase-related information and technical identifiers. Strongbox does not require a Strongbox account or supply RevenueCat with a custom Strongbox account identifier.
Added: The iOS freemium edition also enables Apple Ads attribution through RevenueCat.
Added: Setapp editions communicate with Setapp for activation and subscription management.
Added: Upgrade screens
Added: The iOS freemium edition uses Superwall to display upgrade screens and offers, and to understand how those screens perform.
Added: Superwall can process technical information, SDK-generated and device identifiers, purchase status and app-usage events. It may also use IP-derived approximate location and purchasing-likelihood classifications. Upgrade screens may load additional resources from third-party hosting and content services.
Added: These connections can occur when the app starts, including for users with an active Pro subscription. Turning off crash reporting does not disable Superwall or RevenueCat.
Added: Crash reporting
Added: The iOS app uses Sentry to help us diagnose crashes and reliability problems.
Added: Crash reporting is enabled by default on fresh installations. You can disable it in Strongbox's settings. When disabled, Strongbox skips initialising or closes the crash-reporting SDK.
Added: Crash reporting is intended for technical diagnostics, not collecting the contents of your password database.
Added: Internet connectivity detection
Added: Where available and enabled, Strongbox uses a reachability check involving duckduckgo.com to help determine whether the device is offline. This may involve DNS resolution and system networking activity.
Added: The check does not submit database contents or entry URLs. You can disable connectivity monitoring in Advanced Settings.
Added: Favicon downloading
Added: If you enable automatic favicon fetching or request an icon download, Strongbox may contact the website associated with an entry and configured favicon services, including DuckDuckGo and Google.
Added: These requests disclose the domain being looked up, along with normal connection information such as your IP address. The favicon sources can be configured in Strongbox.
Added: Have I Been Pwned? password checks
Added: If you enable the optional compromised-password check, Strongbox contacts api.pwnedpasswords.com.
Added: It sends the first five characters of a password's SHA-1 hash, not the password or its complete hash. Strongbox compares the returned results locally.
Added: Strongbox Zero
Added: Strongbox Zero is a separate, stripped-down edition with networking features removed or compiled out. It does not have the same integrations as the regular app.
Added: If you use operating-system features or another application to move or synchronise files used by Zero, those services operate under their own settings and privacy policies.
Added: Checking network activity
Added: You can inspect network activity using tools such as Charles, Wireshark or a device firewall.
Added: Exact hostnames can change as Apple, storage providers and other services update their infrastructure. This article describes the purposes of connections rather than a permanent firewall allowlist.
Added: For more information about personal information and service providers, see our Privacy Policy.