Strongbox password manager, uses analytics in the freemium version

"The Application does not use vendors or analytics providers."

Strongbox Privacy Policy, Last Update 9 May 2024, D1 “Do you use vendors or analytics providers?” effective 2024-05-09, retrieved 2026-10-08

On every cold start the app connected to RevenueCat and to four Superwall hosts and sent Superwall 41 to 73 events with a device profile (from 1 s before to 20 s after launch), whether the user had an active entitlement, an expired one or none. The policy of 15 October 2026 names both services.

21 of 21 cold starts recorded in HAR; in the 3 starts recorded only in packet capture, 3 of the 5 host names are visible / devices A, B and C / 1, 3, 5 and 8 Oct 2026

On every launch, the in-app purchase variant of Strongbox connects to RevenueCat and Superwall and sends Superwall several dozen events with a device profile, whether or not the user pays. The privacy policy in force at the time of the study said the app used no vendors or analytics providers; after the authors' questions, the vendor changed it on 15 October 2026.

termsapply / Published 19 Oct 2026 / Tested 1–8 Oct 2026 / 38 min read

Topics Third parties / Identifiers / Telemetry / Location

This prologue describes the authors’ personal experience and impressions; the report itself starts under “In brief”.

We are active Strongbox users. We chose it because it met all our functional requirements. The privacy policy, linked from the app and the App Store, and the support article the policy linked to, answered our doubts. The article also encouraged users to check the connections themselves. We had no concerns.

At the end of September 2026, entirely by chance, one of us was using the iOS App Privacy Report to see how many domains a different app, one used for testing connections, was contacting, and noticed a strangely large number of connections from Strongbox to domains the app’s documentation did not mention (two screenshots: 1, 2). Intrigued, we decided to look into it.

This page is the short report. The full report, with all observations, sources and the complete correspondence, is FULL-REPORT.md; the short report as a file is README.md. Section numbers on this page are the same as in both reports; references of the form “(full report, 3.x)” and “(3.x)” point to the same section of the full report. The exhibits (the run table, the data flow, the request logs and the file list) are on the Evidence page.

On every launch, the tested version of the app connects to two external services: RevenueCat (purchase handling) and Superwall (purchase screens), whether or not the user has a subscription (full report, 3.1). On every start, several dozen events with a device profile go to Superwall, including the device identifier (IDFV), the App Store transaction identifier, model, operating system, language, region, currency, time zone, dark mode and connection type (3.2). The service returns a location derived from the IP address and a purchase propensity score (“demand score”), and the app sends them back in later events (3.5). The same device identifier goes to RevenueCat (3.3).

On the first launch after installation, the app sends an Apple AdServices attribution token to RevenueCat, which in this SDK version has to be switched on by the app (3.4). The content of password databases is not sent. After a database is opened, in the 6 observed unlocks the app sent no events concerning the database (one exception, most likely triggered by the user, is described in 3.8). No connection from Strongbox to Sentry was observed (DNS lookups of sentry.io without a connection, of unestablished origin: section 4).

The privacy policy in force at the time of the study (as of 9 May 2024) stated that the app uses no vendors or analytics providers and collects no location data. The vendor’s article on network connections did not list these services. The vendor’s public statements (post of 26 January 2026, D16; interview of 1 August 2026, D15) described the data as limited to paywall events. After the authors’ questions, the vendor changed both documents (policy: 15 October 2026; article: between 14 and 16 October 2026, according to the authors’ account): the new versions name RevenueCat and Superwall, device identifiers, approximate location derived from the IP address, an estimate of purchase likelihood, and operation with an active subscription (3.1, 3.5).

Most of the observed behaviour matches the default settings of both SDKs; in the app’s public code (state 1.65.0) both SDKs are configured with defaults apart from the StoreKit version, and none of the available options to limit data collection is used (3.10, 3.11). The flow to Superwall is the same on the device with an active subscription, to which, under the configuration, no paywall can be shown. The App Store privacy label lists one data type (“Purchase History”, purpose “Analytics”, not linked to the user) and, according to web archive snapshots, has not changed since 8 January 2026, including after Superwall was added (as of 18 October 2026); the traffic contains data that match Apple’s definitions of Device ID, Coarse Location and Product Interaction (3.9).

connection testDuckDuckGoduckduckgo.com, article item 2IDFV in every requestRevenueCatapi.revenuecat.comfirst launch: receipt, token41 to 73 events per startSuperwallcollector.superwall.meconfigurationSuperwallapi.superwall.meprofile; IP location backSuperwallenrichment-api.superwall.comevery start in HARSuperwallsubscriptions-api.superwall.comfirst launch: 127 to 206 requestsPaywall resourcessuperwalleditor, Fonts, StripeCold startevery launchON DEVICELEAVES ITconnection testDuckDuckGoduckduckgo.com, article item 2IDFV in every requestRevenueCatapi.revenuecat.comfirst launch: receipt, token41 to 73 events per startSuperwallcollector.superwall.meconfigurationSuperwallapi.superwall.meprofile; IP location backSuperwallenrichment-api.superwall.comevery start in HARSuperwallsubscriptions-api.superwall.comfirst launch: 127 to 206 requestsPaywall resourcessuperwalleditor, Fonts, Stripe

Figure 1. Where data goes on a cold start (Exhibit 2 on the Evidence page); dashed: not listed in the vendor’s article of 8 October 2026.

ON YOUR DEVICELEAVES YOUR DEVICEStrongboxevery cold startSuperwallenrichment-api, collectorPOST /api/v1/enricha device profileipCountry, ipRegion, ipCity, ipContinent,ipV4, ipV4ObservedAt,demandScore, demandTierthe same values, in later events:device_attributes, enrichment_complete;demand score and tier also in paywall_openStrongboxevery cold startSuperwallenrichment-api, collectorDEVICESERVICEPOST /api/v1/enricha device profileipCountry, ipRegion, ipCity, ipContinent,ipV4, ipV4ObservedAt,demandScore, demandTierthe same values, in later events:device_attributes, enrichment_complete;demand score and tier also in paywall_open

Figure 2. The enrich exchange on every cold start, field names only (Exhibit 8).

Labels

Each paragraph below is marked in the margin: F for a fact from a file, with its location; D for a document, with its address and date of access; R for the vendor’s replies to the authors of 14 and 16 October 2026, printed in full on the Correspondence page; I for an inference, a conclusion drawn by the authors; H for a hypothesis. Section numbers are the same as in the short and the full report (FULL-REPORT.md, among the files on record). Document codes (D1–D21, EP1–EP7a, P0) refer to the files and addresses listed in sources/README.md.

App: Strongbox - Password Manager, App Store, bundle com.markmcguill.strongbox, version 1.65.2 (build 152), in-app purchase variant; SDKs according to request headers: RevenueCat 5.21.1, Superwall 4.15.3. Out of scope: Strongbox Pro (one-off purchase), Strongbox Zero, the macOS version. Subject: connections made by the app to the RevenueCat and Superwall services and to paywall resources, set against the wording of the vendor’s public declarations. Other connections (Sentry, favicons, the duckduckgo.com connectivity test) were observed but are not the subject of this report. Within the scope examined, no discrepancy with the declarations was found in them (section 4). The report describes what the app sends and when (full report, 1).

Vendor documents as of the time of the study: 8 October 2026. On 15 October 2026 the vendor changed the privacy policy, and between 14 and 16 October 2026 (authors’ account) it changed the article on network connections; both changes followed the authors’ questions, and both versions are given below and in the full report, section 3.

Three iPhones owned by the authors: A (annual Pro subscription, active), B (entitlement through Family Sharing until 3 October, then expired; fresh installation on 3 October) and C (never installed before, no purchase). Tools: Proxyman (macOS) with TLS decryption for the RevenueCat, Superwall and Google Fonts hosts and js.stripe.com (HAR: decrypted HTTP log); Proxyman for iOS on the device in A0, S02, S17 and S18; rvictl + Wireshark (PCAP: full packet capture). Apple domains were not decrypted. Runs (full report, 2):

“Domain filter”: an export that contains only selected hosts (section 5).

A VPN on the router, with its exit in another country, was active in the runs of 3, 5 and 8 October on A and B. This was established from the country derived from the IP address that the Superwall service returns, and from the authors’ account. In total, 24 cold starts (A 12, B 9, C 3).

In the published HAR files (data/), identifiers, tokens, addresses, purchase dates and prices are replaced with labels (the same value gives the same label in every file), server addresses with labels of the form <<IP_n>>, and all timestamps are shifted by a constant random value per run, so times should not be compared between files. From the packet captures only extracts are published, without content (full report, 2, “Pseudonymisation”). A “CONNECT” entry in a HAR file is a connection whose content was not decrypted.

On every start the app contacts the two services, whether or not the user pays.

In each of the 21 cold starts recorded in HAR, the app connected to the following five hosts.

In the 3 starts of T2 (packet capture only, without Proxyman) the names api.revenuecat.com, api.superwall.me and enrichment-api.superwall.com are visible and collector and subscriptions-api are absent. In the 6 captures with DNS answers (S01, S02, S11b, S17, S18, T3) collector resolves to the same addresses as api.superwall.me, and subscriptions-api to the same as enrichment-api. H (T2 only): both hosts share one connection (HTTP/2), so the names would not appear separately. The connections occur whether the user has an active entitlement (A), an expired one (B) or has never made a purchase (C).

D1 (privacy policy, “Last Update: 9 May 2024”, in force at the time of the study; wording: 3.12). D4–D8 (article “What Network Connections Can Strongbox Make?”, snapshot of 8 October 2026): the list of connections covered App Store/StoreKit, the duckduckgo.com connectivity test, favicons (opt-in), Have I Been Pwned (opt-in). D1, version of 15 October 2026: “The iOS freemium app uses Superwall to provide upgrade screens, manage offers and measure their performance.”; D4–D8, new version: names RevenueCat, Superwall, Sentry and Apple Ads attribution.

R (14 October 2026): “the privacy policy update is simply a mistake on our end.” R (16 October 2026): “There is not a release note that mentions Superwall, only the launch post.”

The RevenueCat and Superwall hosts appeared neither in D1 nor in D4–D8 in the versions in force at the time of the study; whether this differed from the wording of D1 depended on whether a payment operator and a paywall operator are “vendors or analytics providers”. The new versions name both providers; the discrepancy concerns the earlier versions (the vendor had named both publicly in D9/D16 and D15, section 4).

Several dozen events with a device profile go to Superwall on every start; the app’s own statements described only