Privacy Policy

1. The short version

MI8OS collects no data. It has no account system, no backend, no analytics, no crash reporting and no advertising. It contains no networking code of any kind, so nothing you put into the app can leave your device and reach us — because there is nowhere for it to go.

MI8OS is published by A. Karapanos, a sole proprietor trading as AxosApps, in Muri AG, Switzerland — the controller for the purposes of this policy, insofar as there is anything to control. Questions go to support@axosapps.com.

2. What MI8OS is

MI8OS is an offline-first encrypted vault for short text secrets. Your vault is encrypted on your iPhone and written to MIFARE DESFire EV3 cards that you hold. There is no cloud copy, no sync service and no server involved at any point.

3. Data we collect

None. Every category in Apple's privacy nutrition label is answered "Data Not Collected". Specifically, MI8OS does not collect contact details, identifiers, usage data, diagnostics, location, contacts, photos, or the contents of your vault.

MI8OS declares no tracking domains and does not track you across apps or websites owned by other companies. The only third-party code in the app is SwiftArgon2, an open-source cryptography library that runs entirely on your device and performs no network activity.

4. Where your data lives

Everything below stays on hardware you control — your iPhone and your cards. Nothing is transmitted anywhere.

Location	What is stored there
Device memory, while the vault is open	The decrypted vault and its encryption key. Both are released when the app locks or goes to the background.
iOS Keychain	A hashed verifier for your app-lock PIN. Never your vault password, your vault key, or your secrets.
iOS User Defaults	Preferences only: app-lock setting, clipboard expiry, onboarding state. No keys, no passwords, no secrets.
Your DESFire card	Your vault, encrypted with a key derived from your password. The card never holds the plaintext vault or the password.
Clipboard	Only a value you explicitly copy. MI8OS clears it after 30 seconds on a best-effort basis.

5. Your vault password

Your password is converted to bytes only to derive the encryption key, after which the temporary buffer is wiped. It is never written to disk, never stored in the Keychain and never placed on a card.

There is no recovery path. Axos Apps holds no escrow, no master key and no copy of your vault. If you forget your password or lose every card, neither we nor anyone else can recover your secrets.

6. Device permissions

NFC is used only to read from and write to your own MI8OS cards. No card data is sent anywhere.
Face ID / Touch ID gates the app lock and gates revealing or copying a secret inside an already-open vault. It never opens a vault and never unlocks a card — each card is opened with its own password. Biometric data stays in Apple's Secure Enclave and is never seen by MI8OS.

7. Children

MI8OS is not directed at children and, since it collects nothing, it collects nothing from children either.

8. Your rights

Rights of access, correction, portability, erasure and objection under the Swiss Federal Act on Data Protection (FADP), the EU/UK GDPR and similar laws apply to personal data a controller holds about you. Axos Apps holds no personal data about MI8OS users, so there is nothing for us to disclose, correct, export or delete. You can erase everything yourself at any time by deleting the app and erasing or destroying your cards.

9. Data sharing and sale

We do not share, sell, rent or disclose user data, because we do not have any. Should we ever receive a lawful request for user data, we would have nothing to produce.

10. Changes to this policy

If MI8OS ever gains a feature that changes any of the above, this policy will be updated before that feature ships, and the "last updated" date at the top will change.

11. Contact

A. Karapanos, trading as AxosApps
Muri AG, Switzerland
support@axosapps.com