Privacy and security
Privacy and security
Keepfin runs on your devices. This page says what it keeps, what it sends, and how your devices protect each other.
No account, no Keepfin server#
- There is nothing to sign up for. Downloads, your library and your copies work on your own devices.
- There is no hosted backend and no usage tracking in the app.
- The app only talks to: the sites you download from, LRCLIB (optional lyrics lookup), GitHub (to check for new versions of Keepfin and the engine inside it), a cloud service if you connect one, and your own paired devices.
What stays on each device#
- Sign-in cookies for sites and cloud account sign-ins. Cloud tokens are stored encrypted on the device that made them, and are never put in your Keepfin folder, on a copy or on another device.
- The download engine, caches and downloads that are still running.
- Your window and screen preferences.
Your Keepfin folder holds your files and your library, which is meant to travel with you. It never holds anyone's sign-in.
How connections between your devices are secured#
When you turn on devices, two of your Keepfin apps talk to each other directly. In plain words:
- Each device has its own secret key that never leaves it. On Windows it is protected by Windows; on Android it lives in the phone's secure key store.
- Pairing is on purpose. You confirm the same six numbers on both devices, or scan a single-use QR code. The numbers are worked out from the connection itself, so someone in between would see different ones. A pairing window is open for two minutes, and wrong attempts are limited.
- Connections are encrypted, and only the device you paired can read them. Each side checks the other's key, and a device that is not paired gets nothing.
- Permissions are deny-by-default. A paired device can sync the library. Playing your files, keeping a copy, downloading for you and managing devices are things you turn on one by one.
- Library changes are signed by the device that made them. If you remove a device, what it writes later is set aside, even when it arrives through a cloud copy.
How it works
Keepfin uses TLS 1.3 with mutual authentication and pinned device keys (no certificate authority). The six-digit check is derived from the connection's own key material, so it is bound to that exact handshake. Segments of library data carry a signature from the device that wrote them. Keepfin listens only while devices are turned on, and only devices you paired are let in.
Cloud accounts#
You sign in in your browser, on the service's own page, so Keepfin never sees your password. Keepfin asks for the narrowest access: Google Drive only the files Keepfin creates, Dropbox its own app folder only. For WebDAV, Keepfin keeps your app password encrypted on this device. See Cloud accounts.
This website#
This website uses Vercel Web Analytics for visits and a small log for download buttons, which are separate from the app and cannot see your library or your links. Read the website privacy page for the details and their limits.
Your content#
Only save content you own or have permission to download. Keepfin is not affiliated with the sites it works with, and it never gets around a login: it uses your own signed-in session.