Privacy information

Updated: 17 October 2026 · TestFlight 1.0.0 (57)

Controller and scope

DomainBoss is a product of Stackswork. The controller for the processing described here is Jochen Abitz (Stackswork), Alstrupvej 20, 9700 Brønderslev, Denmark. Contact: support@stackswork.com. Further business information is available in the Stackswork legal notice.

This supplement covers DomainBoss for macOS, iOS and iPadOS, including its TestFlight beta. The website, support and rights provisions of our general privacy policy also apply. Website analytics, Paddle payments and Stackswork licence activation are not part of the DomainBoss app.

Project information on your devices

DomainBoss stores information you enter or import on your device, such as project names, domains, server details, credentials, notes, categories and search rules. Local processing lets you view, edit, search and copy this information. Display and security preferences are also stored locally.

There is no separate DomainBoss online account and no server operated by us to which the app sends your project contents. The app contains no advertising or third-party analytics SDK. This is separate from the Apple services and user-initiated transfers described below.

App lock and encryption

Values in password/secret fields receive additional AES-GCM encryption in the local database. Key material is protected using your app password and Apple Keychain. The app password is device-specific and is not sent to us as an online password.

Ordinary text fields and notes do not receive this additional field encryption. Locking the app does not mean the entire database is separately encrypted. Store confidential credentials in password fields.

If you choose Face ID or Touch ID, the operating system performs the biometric check. DomainBoss does not receive facial or fingerprint templates; it uses Apple's authentication result.

iCloud and internal sharing

When iCloud is available to the app, DomainBoss automatically synchronizes project contents and personal layout/search settings through Apple CloudKit after unlocking. Local information remains usable without an available iCloud account. This beta has no separate in-app switch to disable synchronization.

The app uses private and explicitly shared CloudKit databases, not a public project database. Your private CloudKit contents are not visible to us through our developer portal. Password values are transferred using CloudKit's dedicated encrypted fields; we do not promise end-to-end encryption of all contents independent of your Apple Account. Apple's processing is described in its privacy information.

When you share a project internally, Apple receives the employee's iCloud email address to identify the participant. Invited participants receive read/write access to the selected project, including its credentials. Revocation ends further cloud access but cannot retrieve information already copied or exported. There is no customer portal. The person or agency using DomainBoss is responsible for having authority to store and share other people's personal information.

Purchases

DomainBoss Pro uses Apple StoreKit. The app requests product information and verified purchase entitlements from Apple to unlock Pro or restore purchases. We do not receive full payment details or Apple Account passwords through this process. There is no separate licence server. Apple's purchase processing is explained in App Store & Privacy.

TestFlight and support

During TestFlight testing, Apple automatically shares usage and crash information with us, such as device/OS details and build numbers. Email invitations can associate your name and email. Comments and screenshots you choose to send are additional data. We use these reports to improve DomainBoss, not for advertising or disclosure to third parties. See TestFlight & Privacy for details and Apple's retention practices.

Use fictional information only in the beta. Remove passwords and confidential information from feedback and screenshots. Direct support messages follow the support section of our general privacy policy; TestFlight diagnostics are not automatically forwarded to our support provider.

Transfers you initiate

CSV imports are processed on your device; imported contents subsequently participate in normal iCloud synchronization. Exports are unencrypted CSV files. An explicitly selected password export also includes passwords in readable form.

Copied values are placed on the system clipboard. The app attempts to remove an unchanged copy after 60 seconds; other apps or clipboard managers may already have copied it. Removal from every recipient cannot be guaranteed.

Opening a website subjects that visit to the destination's privacy practices. On Mac, you can send selected connection details to Beam, Stacks or Transmit. Passwords may also be transferred or copied for pasting. Storage and further use in the destination app are outside DomainBoss.

Optional website AutoFill

You can allow individual website logins for Apple Password AutoFill on each device. DomainBoss makes the website address and username available to the system for login suggestions. Only the logins you explicitly allow are provided.

An encrypted local copy of allowed logins is kept in the device Keychain. Its separate key requires device authentication before a password can be filled. AutoFill can therefore remain available when DomainBoss is closed or app-locked. These AutoFill permissions and copies are not synchronised through iCloud. The original project credentials still participate in the normal project synchronisation described above.

The AutoFill extension has no access to the project database, vault key or network. A chosen password is handed to Apple’s AutoFill system for the selected login. Website links do not include passwords from secret fields. Once a browser fills a website’s form, the website’s own processing applies. Remove individual permissions or all AutoFill permissions under Settings → Website AutoFill on the respective device; this does not delete the original project credentials or retrieve information already entered on a website.

Optional local AI connections on Mac

Local AI access is off by default. If you enable it, DomainBoss provides a connection on this Mac only while the app is running and unlocked. Each named AI app or provider requires your explicit consent and its own access key. You choose which projects it may read or change; creating projects is a separate permission.

Allowed connections can receive project names, domains, non-secret fields, notes and tasks. Values in password and other secret fields are excluded from this integration. The AI provider used by your chosen app may process the information it receives under its own privacy policy, including on external servers. A local connection does not mean that provider's processing stays on your Mac. Share only information you are authorised to disclose.

You can revoke a connection or turn off local AI access in Settings → AI Access. This stops future access but cannot retrieve information already received by an AI app or provider. DomainBoss stores only a hash of each access key and the project permissions locally; these are not synchronised through iCloud. Stackswork does not receive your project contents through this endpoint.

Retention, legal bases and your rights

Project information remains in the respective local and iCloud stores until removed there. Archiving is not deletion. Uninstalling the app alone does not reliably remove iCloud contents, Keychain items, backups or exports. This beta has no central function to erase all local and cloud data. Contact us for assistance with cleanup; our developer account cannot delete your private iCloud contents on your behalf.

We retain support and defect reports we handle only as long as necessary to address the request and investigate the issue, then delete or anonymize our copies unless legal obligations or specific legal claims require retention. Apple's own retention is governed by its notices.

Where we process personal information to provide the agreed app/support service, we rely on Article 6(1)(b) GDPR. Error analysis and improvement rely on our legitimate interest in a secure, functioning app under Article 6(1)(f); legal obligations rely on Article 6(1)(c). These bases do not replace Apple's own legal bases or your agency's basis for processing customer information.

You may contact us about access, rectification, erasure, restriction, portability and objection. Applicable legal conditions and the additional information in our general privacy policy apply, including its information about the Danish supervisory authority. You can also use Apple's Data and Privacy portal for information associated with your Apple Account. DomainBoss does not make automated decisions with legal or similarly significant effects.

Visiting this website

domainboss.app is hosted on our VPS and delivered through Cloudflare. Technical request information, such as IP address, timestamp, requested page, browser details and response status, is processed to serve the website, investigate errors and protect it against attacks. The legal basis is our legitimate interest in a secure, reliable website under Article 6(1)(f) GDPR.

Web-server logs rotate daily, with 14 rotated log files retained. Backup copies and records relating to specific security incidents may remain longer. Cloudflare processes information under its privacy policy, including outside the European Economic Area; that policy describes its transfer mechanisms.

This beta website embeds no analytics, advertising or form scripts. Fonts and the app icon do not require external font or image services. If you visit stackswork.com, its own website provisions apply.