# Security

> Learn how BucketMate for iOS stores credentials and which data stays on your iPhone

Canonical: https://docs.bucketmate.app/ios/advance/security

BucketMate for iOS keeps storage credentials on your iPhone. Requests go directly from the app to your storage provider. BucketMate servers do not receive S3 credentials or object data.

```mermaid
flowchart TD
  App["BucketMate for iOS"] --> Keychain["iOS Keychain"]
  Keychain --> Secrets["Access key, secret key, session token"]
  App --> Local["On-device storage"]
  Local --> Meta["Connection names, endpoints, regions, cache"]
  App -- "signed S3 requests" --> Provider["S3 storage provider"]
  App -- "purchases, license sign-in, telemetry" --> Servers["BucketMate, RevenueCat, App Store"]
  App -. "no S3 credentials or object data" .-> Servers
```

## Where data is stored

| Data | Location |
| --- | --- |
| Access key ID, secret access key, session token | iOS Keychain, as generic password items available after the first unlock |
| Connection name, provider, endpoint, region, bucket list | App preferences on the device |
| Cached buckets, folder listings, and bucket metrics | On-device database with iOS complete file protection |
| Preview thumbnails | App cache folder on the device |
| Shared link history | App preferences on the device |
| License sign-in session | iOS Keychain |

Keychain items use the "after first unlock" accessibility class, so they are not readable until you unlock the iPhone once after a restart.

## Deleting data

- Deleting a connection removes its metadata, its Keychain secrets, and its cached data.
- Editing a connection clears its cached data.
- **Settings** > **Clear cache data** removes all cached listings, metrics, and preview thumbnails.
- **Delete from history** or **Clear** in **Shared links** removes link history only. It does not revoke links.

## Quick Connect QR codes

A Quick Connect QR code contains the full connection, including the access key and secret key. Treat it like a password.

- Show it only on a screen you control, and scan it only with your own iPhone.
- Close the QR code on your Mac after scanning.
- The QR code is read on the device. Its contents are not sent to BucketMate servers.

## Network traffic

- Bucket and object operations are signed on the device and sent straight to your storage provider.
- Custom S3-compatible endpoints must use HTTPS.
- File preview thumbnails use short-lived presigned URLs that expire after 5 minutes.
- In-app purchases go through the App Store and RevenueCat.
- **Sign in** on the upgrade screen sends your email to the BucketMate API to verify a license.
- Usage analytics and error reports are sent to PostHog. BucketMate removes properties such as credentials, endpoints, regions, bucket names, object keys, file names, URLs, and emails before sending.