Data Protection

Q: How is my data encrypted?

Maexry encrypts all data at rest using AES-256-GCM via SQLCipher — the same standard used in banking and defense applications. But encryption alone is only half the story. What matters is the key architecture.

A single 256-bit Master Seed, generated by a cryptographically secure random number generator, is the root of all encryption. From this seed, nine purpose-specific keys are derived using HKDF-SHA256 with unique context strings — one for the database, one for your API keys, one for OAuth tokens, one for settings sync, and so on. Each key is cryptographically independent: compromising one does not compromise the others. The Master Seed itself is never held in memory beyond the initial unlock — it is derived, used to produce all nine subkeys, and immediately zeroized. On macOS, the subkey memory is pinned in RAM (mlock) to prevent it from being swapped to disk.

Q: Where are my encryption keys stored?

Your Master Seed is encrypted by a P-256 asymmetric key generated inside your device's Secure Enclave. This requires a Mac with Apple T2 chip (2018+) or Apple Silicon (M1+). The hardware key is physically non-exportable — no software, including Maexry, can read it. The Secure Enclave performs encryption and decryption operations internally; the key material never enters main memory.

To unlock your data, you authenticate with biometrics (Face ID, Touch ID) or your device passcode. The Secure Enclave decrypts the Master Seed, the app derives all nine subkeys, and the seed is immediately wiped from RAM. Operations that need the raw seed later (like exporting a backup) require a fresh biometric authentication each time.

Q: Can Maexry read my data?

No — and this is not a policy claim. It is an architectural guarantee.

Your encryption keys exist only on devices you control. Maexry's servers store and relay encrypted blobs, but hold no key material. Even under a complete server compromise, an attacker would see only ciphertext indistinguishable from random noise. There is no "admin key," no escrow, and no key on our servers that can decrypt your data. The Dark Blob backup is wrapped with a password only you know, using Argon2id with 64 MB of memory cost — so recovering it requires your password, and brute-forcing it is computationally infeasible. We can't read your email because we hold no key that can decrypt it — a matter of cryptographic design, not a promise we ask you to take on trust.

Q: What happens if I lose my device?

You have two recovery paths, both designed so that Maexry never sees your keys:

Password Recovery (Dark Blob): During setup, you create an encrypted backup of your Master Seed protected by a password you choose. This backup is stored on our server as a "Dark Blob" — encrypted with Argon2id (64 MB memory, 3 iterations, 4 parallel lanes). On a new device, you enter your password, the blob is decrypted locally, and a fresh Secure Enclave key re-wraps the seed on the new hardware. Without the correct password, the blob is useless.

QR Transfer: If you still have your old device, you can transfer the Master Seed across directly. Your existing device generates a fresh, single-use random key, encrypts the seed with it (AES-256-GCM), and uploads only the ciphertext to a short-lived relay. It then displays a QR code holding that key and a one-time relay token. Your new device scans the code, fetches the ciphertext from the relay, and decrypts it locally with the key from the QR. The key travels only inside the QR — screen to camera — and never touches our servers. The relay holds only ciphertext, is single-use, and expires after 60 seconds.

Q: How does multi-device sync work without exposing my data?

The key insight is deterministic key derivation. Every device that holds the same Master Seed derives the exact same nine subkeys — same seed plus same context string always produces the same key. This means Device A and Device B can independently encrypt and decrypt the same data without ever exchanging keys after the initial seed transfer.

Synced data — settings, classification results, intelligence data — is encrypted on the sending device with the appropriate HKDF subkey, uploaded as an opaque blob, and decrypted on the receiving device with the locally-derived copy of the same key. The server is a relay, not a participant. It stores and forwards blobs it cannot read.

Q: What is BYOK and why does it matter?

BYOK (Bring Your Own Key) means you connect your own API key from a supported provider — OpenAI, Anthropic, or Google — and Maexry uses it to classify and analyze your email. Your API key is encrypted at rest with a dedicated HKDF subkey and sent directly to the provider over TLS. It never passes through Maexry's servers.

This matters for three reasons. First, privacy: your email content goes directly from your device to a provider you chose, under an agreement between you and them. Second, cost: you pay the provider's wholesale API rate (typically under $0.50/month for email classification) instead of a markup bundled into a subscription. Third, control: you can switch providers, use a local Ollama instance via the Bridge Engine, or disable cloud AI entirely.

Q: What happens to my data when it reaches an AI provider?

When you use Maexry's AI features, your device sends email content directly to your chosen AI provider (e.g., Google Gemini, OpenAI, Anthropic) via their API over TLS. Maexry facilitates this connection but is never in the data path — your email content goes straight from your device to your provider, under the terms of service between you and that provider.

Maexry does not proxy, log, or store any data sent to AI providers. Your API keys are encrypted at rest with a dedicated HKDF subkey and never leave your device's secure storage.

Q: Who makes Maexry?

Maexry is built by Maexry LLC, a US company based in Atlanta, Georgia. We believe trust starts with accountability — you should know exactly who is behind the software that handles your email. Maexry is a registered US entity, subject to US law, with an identifiable team and a physical presence. We chose to build Maexry's zero-knowledge architecture precisely because we believe the best way to earn trust is to remove the need for it: if we cannot access your data by design, the question of whether you should trust us becomes moot.