Permissions & Privacy
Why Touch ID prompts appear, what lives in the Keychain, and what never leaves your Mac.
Developers Kit is deliberately paranoid about your secrets. This page explains every prompt you'll see, in plain English.
The short version
- Nothing is sent to any server. No sync, no cloud, no telemetry, no crash reporting. Ever.
- Secrets live in the macOS Keychain or in encrypted files on your Mac — never in plaintext on disk.
- Touch ID (or your Mac password) guards the sensitive moments — revealing a secret, exporting a file full of passwords, or writing to a production database.
When will I see a Touch ID prompt?
| You do this | Why it asks |
|---|---|
| Reveal an environment variable's value in ENV Manager | The value comes out of the Keychain in plaintext — it asks every time |
Export a .env file | Same reason: plaintext secrets are leaving the vault |
| Unlock the Password Manager with Touch ID | Faster than typing your master password |
| Export your passwords to CSV | A CSV is plaintext — the app confirms it's really you |
| Run a write on a production database profile | Safe mode level "Touch ID for production" gates it |
No Touch ID on your Mac? Every prompt falls back to your macOS login password. Same protection, more typing.
Where your data actually lives
| Data | Where |
|---|---|
| Password vault | An encrypted file (vault.pwvault) in the app's private container, sealed with keys derived from your master password |
| ENV values | macOS Keychain, one entry per secret |
| Database passwords | macOS Keychain, one entry per connection profile |
| Clipboard history | A local database in the app's private container (images stored as local files) |
| Query history, connection profiles (no secrets) | Local files in the app's private container |
The app is sandboxed — macOS itself walls its data off from other apps.
What about the breach check in Watchtower?
The Password Manager's Watchtower can check whether a password appeared in a known data breach. Here's the caveman version of how that stays private: your password is scrambled into a fingerprint (SHA-1 hash), and only the first 5 characters of that fingerprint are sent to the Have I Been Pwned database. The database sends back every fingerprint starting with those 5 characters, and the match happens on your Mac. The service never sees your password — and can't reconstruct it.
If the check can't run (no network, service down), the app says "check failed". It never falsely says "safe".
No accounts, no analytics
There is no sign-up, no license server, and no usage tracking of any kind. Questions or doubts? Email support@developers-kit.com.