Privacy Policy

Effective date: January 24, 2026
Last updated: February 25, 2026

1. Introduction

This Privacy Policy explains how HKeys.app (“Service”, “we”, “us”) collects, uses, shares, and protects information when you access or use our website, applications, and related services.

2. Scope

This Privacy Policy applies to personal data processed through the Service. It does not apply to third-party websites, services, or applications that may be linked from the Service. Those third parties have their own privacy policies.

3. Information we collect

3.1 Information you provide

Account and profile information: such as your email address, account identifier, and account data you save in the Service (for example, favorites and preferences).
Support communications: content you send to us (e.g., emails, feedback, bug reports) and related metadata (such as time and method of contact).
Account-related requests: information related to account access or deletion requests that you initiate (for example, your email address and request metadata needed to send and verify confirmation emails).

3.2 Information collected automatically

Device and usage data: IP address, device identifiers, browser type, operating system, language settings, pages viewed, links clicked, and timestamps.
Log data: server logs may include request details, error reports, and diagnostic information.
Cookies and similar technologies: used for essential functionality, preferences, analytics, and security (see Section 6).

3.3 Information from third parties

We may receive limited information from service providers we use to operate the Service. For example, Supabase may provide authentication/session and account identifier data, and Resend may provide transactional email delivery metadata. We do not currently offer social login via Google, Apple, or GitHub.

4. How we use your information

We process personal data for the following purposes:

Provide and operate the Service (e.g., account creation, login, delivering features).
Maintain security (e.g., preventing fraud, abuse, unauthorized access).
Improve and develop the Service (e.g., debugging, performance analysis, feature usage insights, including consent-based analytics in production deployments).
Communicate with you (e.g., respond to support requests, send service-related notices).
Send transactional emails (e.g., sign-in magic links and account deletion confirmation emails).
Comply with legal obligations (e.g., tax, accounting, lawful requests).

5. Legal bases (EEA/UK and similar jurisdictions)

If you are located in the European Economic Area (EEA), United Kingdom, or a jurisdiction with similar requirements, we rely on the following legal bases to process personal data:

Contract: to provide the Service you request (e.g., account features).
Legitimate interests: to secure, maintain, and improve the Service, prevent abuse, and understand usage. We balance these interests against your rights.
Consent: where required (e.g., analytics cookies/scripts such as Google Analytics and Microsoft Clarity).
Legal obligation: to comply with laws and regulations.

6. Cookies and similar technologies

We use cookies and similar technologies (including local storage and session storage) to operate the Service, maintain authentication and security-related flows, remember preferences, and understand how the Service is used.

6.1 Types of cookies

Strictly necessary: required for core functionality and security (e.g., session management, authentication).
Preferences: remember settings (e.g., UI and consent preferences).
Analytics: help us measure performance and usage patterns to improve the Service (currently via Google Analytics and Microsoft Clarity, after consent).

6.2 Managing cookies

You can control cookies through your browser settings. Disabling strictly necessary cookies may cause parts of the Service to stop working.

For analytics cookies/scripts, we currently show an in-product consent banner. Your choice is stored in the cookie hk_cookie_consent_analytics with value granted or denied for up to one year.

If you decline, analytics scripts are not loaded. You can also delete the consent cookie in your browser to reset the choice and see the banner again.

7. Sharing and disclosure

We do not sell your personal data. We may share personal data in the following situations:

Service providers (processors): hosting and infrastructure (including Vercel), authentication/database/session infrastructure (Supabase), transactional email delivery (Resend), and analytics providers (Google Analytics and Microsoft Clarity, only after consent). These providers process data on our instructions and under contractual obligations.
Legal requirements: when required by law, regulation, legal process, or lawful request, or to protect rights, safety, and security.
Business changes: if the Service is reorganized, merged, or transferred, personal data may be transferred as part of that transaction, subject to safeguards.

8. International data transfers

Your data may be processed in countries other than your own, depending on where we or our service providers operate. Where required, we use appropriate safeguards for international transfers (for example, contractual protections).

Where required, we rely on Standard Contractual Clauses and other lawful transfer mechanisms.

9. Data retention

We retain personal data only as long as necessary for the purposes described in this Privacy Policy, including:

for as long as your account is active or needed to provide the Service;
as necessary to comply with legal obligations (e.g., accounting or tax);
for limited periods for security artifacts such as rate-limiting records and account deletion confirmation tokens;
to resolve disputes and enforce agreements.

When data is no longer needed, we delete or anonymize it, or store it securely until deletion is possible.

10. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal data from unauthorized access, loss, misuse, alteration, or disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights and choices

Depending on your location, you may have rights regarding your personal data, including:

Access: request a copy of the personal data we hold about you.
Correction: request that we correct inaccurate or incomplete data.
Deletion: request deletion of your data, subject to legal exceptions.
Objection / restriction: object to or request restriction of certain processing.
Withdraw consent: where processing is based on consent, you can withdraw it at any time.
Complaint: you may lodge a complaint with your local data protection authority.

To exercise your rights, contact us at info@hkeys.app. We may need to verify your identity before fulfilling requests.

12. Children’s privacy

The Service is not intended for children who are under the minimum age required to provide consent for the processing of personal data in their jurisdiction. We do not knowingly collect personal data from such children, and we do not permit them to create an account.

Creating an account and purchasing a subscription are intended only for users who meet the applicable age requirements.

If we learn that a user is below the applicable minimum age, or that we have collected personal data from a child, we will delete or de-identify that information and may suspend or terminate the related account.

If you believe that a child has provided us with personal data, please contact us at info@hkeys.app.

13. Third-party services

The Service currently integrates third-party services for hosting and infrastructure (including Vercel), authentication/database/session infrastructure (Supabase), transactional email delivery (Resend), and analytics (Google Analytics and Microsoft Clarity, after consent in production deployments). These providers may process data according to their own privacy policies. We encourage you to review the applicable third-party policies.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice as appropriate (for example, by posting an updated policy on this page and updating the “Effective date”).

15. Contact

For questions or requests regarding privacy and this Privacy Policy:

Email: info@hkeys.app