From bf176c13dfd502fb923dc946d42c3c28e9c39a78 Mon Sep 17 00:00:00 2001 From: Eugen Kaparulin Date: Wed, 30 Sep 2026 11:34:56 +0300 Subject: [PATCH] Correct key-storage and platform claims: name only platforms that ship The README contradicted itself. Line 11's platform badge advertised `Linux | macOS | Android | iOS` while line 87 of the same file said `### macOS . iOS -- Coming soon`. Neither macOS nor iOS has ever shipped. Three claims named iOS Keychain and macOS Keychain as active key stores: - README "Key storage" said "On every platform ... (iOS Keychain, macOS Keychain, Android Keystore)" -- for a product whose platform list ends at Android. - privacy-policy.md named `Android Keystore / iOS Keychain` for both credential storage and PGP private keys, which has it doubly wrong: it names a platform that does not ship and omits the two that do. Verified against the implementation rather than reworded from memory. mailcore uses the Rust `keyring` crate v3 with the `sync-secret-service` feature (mailcore/Cargo.toml:58); the Flutter side uses `flutter_secure_storage` ^10.0.0. So on the shipped platforms the stores are Windows Credential Manager, Android Keystore, and the Secret Service (libsecret) on Linux -- now what the docs say. privacy-policy "last updated" moved to 30 September 2026. --- README.md | 4 ++-- privacy-policy.md | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index fffea35..325142e 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ **PGP-First Email. Private by Default.** [![License: PolyForm Noncommercial](https://img.shields.io/badge/license-PolyForm%20Noncommercial-blue)](LICENSE) - [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20macOS%20%7C%20Android%20%7C%20iOS-lightgrey)]() + [![Platform](https://img.shields.io/badge/platform-Linux%20%7C%20Windows%20%7C%20Android-lightgrey)]() [![Status](https://img.shields.io/badge/status-Beta-orange)]() @@ -187,7 +187,7 @@ The PGP/Sequoia integration, advanced privacy features, the proprietary Rust eng ## Security -**Key storage:** Private keys are never written to SQLite or disk in plaintext. On every platform, they are stored in the OS secure enclave (iOS Keychain, macOS Keychain, Android Keystore). +**Key storage:** Private keys are never written to SQLite or disk in plaintext. On the platforms that ship, they go to the OS credential store — Windows Credential Manager, Android Keystore, or the Secret Service (libsecret) on Linux. ## Notices diff --git a/privacy-policy.md b/privacy-policy.md index 3a004f9..cc833fa 100644 --- a/privacy-policy.md +++ b/privacy-policy.md @@ -1,6 +1,6 @@ # Korax Privacy Policy -_Last updated: 22 May 2026_ +_Last updated: 30 September 2026_ ## Who we are @@ -13,7 +13,7 @@ Korax connects directly to your email provider using the IMAP and SMTP protocols | Data | Purpose | Where it is stored | |------|---------|-------------------| | IMAP/SMTP server addresses, port, and TLS settings | Connect to your mail server | On-device SQLite database | -| Email account credentials (username and password) | Authenticate with your mail server | OS secure credential store (Android Keystore / iOS Keychain) | +| Email account credentials (username and password) | Authenticate with your mail server | OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) | | Email message content (headers, body, attachments) | Display your mail | On-device SQLite cache | | Email addresses of senders and recipients | Display contacts and compose mail | On-device SQLite database | | PGP keys you generate or import | Encrypt and decrypt mail | On-device SQLite database | @@ -38,7 +38,7 @@ All data is stored locally on your device. To delete your data, remove your acco - Credentials are stored in the OS secure credential store and are not accessible to other apps. - All connections to mail servers use TLS encryption. -- PGP private keys are stored in the OS secure enclave (Android Keystore / iOS Keychain) and never written to disk in plaintext. +- PGP private keys are stored in the OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) and never written to disk in plaintext. ## Children