korax/korax-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Correct key-storage and platform claims: name only platforms that ship

Browse Source 
The README contradicted itself. Line 11's platform badge advertised
`Linux | macOS | Android | iOS` while line 87 of the same file said
`### macOS . iOS -- Coming soon`. Neither macOS nor iOS has ever shipped.

Three claims named iOS Keychain and macOS Keychain as active key stores:

- README "Key storage" said "On every platform ... (iOS Keychain, macOS
  Keychain, Android Keystore)" -- for a product whose platform list ends at
  Android.
- privacy-policy.md named `Android Keystore / iOS Keychain` for both
  credential storage and PGP private keys, which has it doubly wrong: it
  names a platform that does not ship and omits the two that do.

Verified against the implementation rather than reworded from memory.
mailcore uses the Rust `keyring` crate v3 with the `sync-secret-service`
feature (mailcore/Cargo.toml:58); the Flutter side uses
`flutter_secure_storage` ^10.0.0. So on the shipped platforms the stores
are Windows Credential Manager, Android Keystore, and the Secret Service
(libsecret) on Linux -- now what the docs say.

privacy-policy "last updated" moved to 30 September 2026.
This commit is contained in:
Eugen Kaparulin
2026-09-30 11:34:56 +03:00
parent 4a7a08244f
commit bf176c13df
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
privacy-policy.md
View File

@@ -1,6 +1,6 @@
# Korax Privacy Policy
_Last updated: 22 May 2026_
_Last updated: 30 September 2026_
## Who we are
@@ -13,7 +13,7 @@ Korax connects directly to your email provider using the IMAP and SMTP protocols
| Data | Purpose | Where it is stored |
|------|---------|-------------------|
| IMAP/SMTP server addresses, port, and TLS settings | Connect to your mail server | On-device SQLite database |
| Email account credentials (username and password) | Authenticate with your mail server | OS secure credential store (Android Keystore / iOS Keychain) |
| Email account credentials (username and password) | Authenticate with your mail server | OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) |
| Email message content (headers, body, attachments) | Display your mail | On-device SQLite cache |
| Email addresses of senders and recipients | Display contacts and compose mail | On-device SQLite database |
| PGP keys you generate or import | Encrypt and decrypt mail | On-device SQLite database |
@@ -38,7 +38,7 @@ All data is stored locally on your device. To delete your data, remove your acco
- Credentials are stored in the OS secure credential store and are not accessible to other apps.
- All connections to mail servers use TLS encryption.
- PGP private keys are stored in the OS secure enclave (Android Keystore / iOS Keychain) and never written to disk in plaintext.
- PGP private keys are stored in the OS secure credential store (Windows Credential Manager / Android Keystore / Secret Service on Linux) and never written to disk in plaintext.
## Children