Privacy Policy
Keyfold is a macOS productivity app. This page explains what data we collect, how we use it, and the rights you have over it. Plain language, no surprises.
What we collect
We only collect what's needed to run the product:
- Account info — your name and email when you sign up with email + password, or the equivalent profile fields shared by your OAuth provider (Google).
- Authentication metadata — session tokens, IP address, and user agent, used to keep you signed in and prevent abuse.
- Widgets you submit — the ZIP files, metadata, and screenshots you upload to the Keyfold widget store, plus the email address of the developer.
- Anonymous usage analytics — aggregate page views and visit metadata, with no individual tracking beyond the session itself.
We do not collect your keystrokes, the contents of your clipboard, the apps you launch, or anything from inside the Keyfold desktop app itself. That data stays on your machine.
How we use it
- To authenticate you and keep your session active.
- To review, host, and serve widgets you submit to the store.
- To respond to support requests and communicate with you about your account.
- To detect and prevent abuse, fraud, and security issues.
- To understand which parts of the site work and improve them.
We do not sell your data. We do not share it with advertisers. We do not use it to build profiles for any third party.
Where it lives
We rely on a small set of service providers to run Keyfold. Each one stores or processes some part of your data on our behalf:
- Supabase — Postgres database and object storage for accounts, sessions, and submitted widgets.
- Vercel — web hosting for keyfold.io.
- Google — OAuth sign-in (only used if you choose "Sign in with Google").
- Resend — transactional email delivery (account-related emails only, when applicable).
Cookies
We use a small number of strictly-necessary cookies:
- A signed session cookie issued at login. Without it, the site can't tell you're signed in.
- An OAuth state cookie set briefly during third-party sign-in to prevent CSRF attacks. It expires after the OAuth callback completes.
We do not use third-party advertising or tracking cookies.
Your rights
You can:
- Access a copy of the personal data we hold about you.
- Correct anything inaccurate.
- Delete your account and the data associated with it.
- Export a portable copy of your data.
- Withdraw consent for any optional processing.
Email harshit@keyfold.io with your request. We respond within 30 days.
Data retention
We keep your account and submitted widgets for as long as your account is active. When you delete your account, we remove your personal data within 30 days, except for limited records we're legally required to retain (e.g. for fraud prevention or tax purposes).
Children
Keyfold is not directed at anyone under 13. If we learn we've collected data from a child, we'll delete it.
Changes to this policy
If we make material changes, we'll update the "Last updated" date at the top and, when appropriate, give you notice in-product or by email.
Contact
Questions, requests, or complaints: harshit@keyfold.io.