The short version
Kainor LLC never receives your organization's data. LAPSlock is a client application. When you look up a device or reveal a password, that request goes from your iPhone directly to Microsoft. It does not pass through any server we operate, because we don't operate one in that path.
We collect no analytics, no telemetry, no crash reports, and no usage statistics. There is no account to create with us. Diagnostic information is gathered only when you tap a button, stays on your device until you choose to send it, and cannot contain a password or a recovery key.
The sections below say the same thing in more detail, because "trust us" isn't good enough for an app that handles administrator credentials.
Who we are
LAPSlock is made by Kainor LLC, a limited liability company registered in Kansas, United States. For any question about this policy, email connor@kainor.com.
What LAPSlock does with your organization's data
LAPSlock reads device inventory, local administrator passwords, and BitLocker recovery keys from Microsoft Entra ID and Microsoft Intune. If you turn on Show user names in Settings, it also reads the display names of devices' primary users; that option is off by default, adds one read-only permission when enabled, and the names it retrieves are held in memory for the session and never stored. All of that is your organization's data, held in your organization's Microsoft tenant.
The app requests it using delegated access: it acts as the person signed in, using their existing Microsoft permissions. It has no independent access of its own. If your account cannot read a password in the Microsoft admin center, LAPSlock cannot read it either.
That data travels between your device and Microsoft over TLS. It is not sent to Kainor LLC, and we have no technical means to intercept, view, or retain it.
What is stored on your device
| What | Where | How long |
|---|---|---|
| Microsoft sign-in tokens | iOS Keychain, marked device-only so they are not synced to iCloud or any other device | Until you sign out, or until Microsoft expires them |
| Device inventory you have browsed (names, models, compliance state) | App memory, scoped to the tenant you are signed in to | Cleared when you sign out, switch accounts, or close the app |
| A revealed password or recovery key | App memory only | Overwritten when you hide it, when the timer expires, or when the app leaves the foreground |
| Your settings (appearance, whether rotation is enabled) | Standard iOS app preferences | Until you change them or delete the app |
| Diagnostic events | App memory only, never written to disk | Cleared when the app closes |
| Your organization's license token, if you activated one | iOS Keychain, marked device-only so it is not synced to iCloud or restored to another device | Until you remove the license in Settings; refreshed about monthly |
Credentials are never written to disk, never included in an iOS or iCloud backup, and never written to a log file.
Clipboard
If you copy a password or recovery key, LAPSlock marks the clipboard item as local-only, so iOS does not sync it to your Mac or iPad through Universal Clipboard, and sets it to expire automatically after 90 seconds. LAPSlock also clears it when the reveal window ends, if it still holds the value we placed there.
What we collect
Nothing automatically. Specifically, LAPSlock contains no analytics SDK, no telemetry, no crash reporting service, no advertising identifier, and no third-party tracking of any kind. We do not know how many devices you looked up, which ones, or whether you used the app today.
This is enforced in the code, not just promised: the module that handles credentials is compiled with no logging or analytics dependency available to it, and the build fails if one is added. The source is published so you can verify that claim yourself.
If your organization buys a license
Organization licenses are keyed to a Microsoft tenant. For each paying organization, Kainor LLC keeps the tenant ID, the license tier, its term dates, and an order reference. That is the whole record. It contains no person's name or email address — those stay with the payment processor as a billing record — and nothing about how the app is used. A tenant ID identifies an organization, not a person.
Our license server does not log tenant IDs. Its request logs are the ordinary kind every web service has (a timestamp, a source address, a status code), kept briefly, and they cannot show which devices were looked at, which credentials were revealed, or who did the looking, because none of that is ever sent.
Diagnostics you choose to send
If you tap Gather diagnostics in Settings, the app assembles a report and shows it to you. Nothing is transmitted until you choose to email or share it. The report contains:
- Which operations ran and whether they succeeded
- HTTP status codes and Microsoft Graph request identifiers
- Endpoint templates, such as
/directory/deviceLocalCredentials/{entraDeviceId}, with real identifiers never substituted in - App version, iOS version, and device model
- Your Microsoft tenant ID, only if you switch that option on
It cannot contain a password, a recovery key, a username, a device name, or any response from Microsoft. Those values have nowhere to go in the report's structure. You can read the entire report before sending it.
Network connections
LAPSlock connects to exactly two hosts:
login.microsoftonline.com— Microsoft sign-ingraph.microsoft.com— Microsoft Graph, where your data lives
A third host is contacted only if your organization activates a paid license in Settings, and never before:
kainor-lapslock-prod-func.azurewebsites.net— Kainor's license check
That request contains your Microsoft tenant ID and nothing else: no sign-in token, no user name, no device information, and no count of anything you have done in the app. It is made when you tap Activate, then roughly once a month, and never in response to anything you look up or reveal. The full request and response format, what our server keeps, and how to check all of it with a proxy are published in the entitlement API contract.
You can verify this yourself with a network proxy in about ten minutes. We think observed behavior is better evidence than a privacy policy, which is why we're telling you how to check.
Children
LAPSlock is a tool for IT administrators. It is not directed at children, and we do not knowingly collect information from anyone, including children.
Your rights
Data protection laws such as the GDPR and the CCPA give you rights to access, correct, and delete personal information a company holds about you. Kainor LLC holds no personal information about LAPSlock users, so there is nothing for us to produce or erase. If you email us and we are holding something we have not described here, we will tell you and delete it.
For your organization's data in Microsoft Entra ID and Intune, those requests go to your own IT department or to Microsoft, since that is where the data lives.
Changes
If this policy changes, the effective date at the top changes with it, and the previous version remains available in the public repository's history. Material changes to how data is handled will be described in the app's release notes.
Not affiliated with Microsoft
LAPSlock is an independent product. Kainor LLC is not affiliated with, endorsed by, or sponsored by Microsoft Corporation. Microsoft, Microsoft Entra, Microsoft Intune, Windows, and BitLocker are trademarks of Microsoft Corporation.