Privacy policy.

Last updated: 1 October 2026 · Contact: store@keyhole.agency

Who handles your information

Daniil Obukhov operates this KeyHole website. Contact us at the email above for privacy and support requests.

Information we process

For reviews we collect the name, email address, rating, title, text and optional images you submit. For orders, we collect the buyer email, order and payment status, license reference and delivery status. We do not receive or store payment card numbers. Do not include private information about other people in reviews or images.

Reviews and moderation

Submitting a review asks us to consider publishing it. After approval, your name, rating, text, images and submission date are public. Reviews are moderated for relevance, spam, personal information and abusive content. Positive and negative experiences are welcome. We do not label a review as a verified purchase without purchase verification. Contact us to correct or remove your review.

Contact messages

The contact form opens your email application. It does not send your message to this website. If you send the email, we receive the information in it and use it to answer your enquiry or provide support.

Local storage and technical data

The cart, helpful-review selections and cookie preferences are saved in your browser’s local storage. Cookie preferences expire after 180 days. You can clear them in your browser settings. The server uses your network address to limit repeated requests and votes; vote identifiers are keyed hashes rather than published addresses. Cloudflare may process security and access logs to host and protect the site.

Welcome codes

If you request a first-order code, we store your email, code, issue and expiry times, and redemption status to validate the offer and prevent reuse. The code is shown on screen and is linked to your purchase email. Product-news subscription is optional and recorded separately. Your saved code and email may be kept in this browser so you can apply the code at checkout.

Keeping free limits fair

To keep free limits fair and stop automated sign-ups, we check a few signals when you sign in or use a free export: your mailbox, written the same way however it’s spelled; a first-party cookie, __Host-kh_dev, set when you sign in and lasting 90 days; and your connection with the kind of browser you use. We keep only keyed hashes of these, for 35 days, and any resulting flag for up to 90 days. They’re never used for advertising and never shared to track you. We don’t run our own scripts to fingerprint your device. On the sign-in and account pages we use Cloudflare Turnstile, a check that most people never see. Cloudflare receives your IP address, TLS fingerprint and browser details for it, under its Turnstile Privacy Addendum. These checks never affect payments, and a flag only limits free features. If you think one is wrong, write to store@keyhole.agency and a person will review it. You can see any flags in your data download, and deleting your account removes them; a count of this month’s free use stays as a hash until the month ends, so that deleting an account doesn’t reset a limit.

Optional analytics

With your permission, Google Analytics 4 measures page visits, button clicks, scroll depth, active time in sections and checkout stages, plus technical information such as browser, device and approximate location. Microsoft Clarity produces heatmaps and masked session recordings. Google uses first-party analytics cookies, including _ga and _ga_*. Google analytics cookies are limited to 180 days. Clarity also uses first-party _clck and _clsk cookies. We load neither Google Analytics nor Microsoft Clarity until you accept analytics and recordings. Advertising signals and personalization are disabled. Private order pages are excluded, and page URLs sent by our code omit query strings and fragments. Form contents, personal codes and status messages are masked in recordings. Private order and account pages are excluded from both browser trackers. We do not send license keys, order access tokens, email addresses or payment details to either tracker. With consent, a verified payment may send its amount and an opaque transaction identifier to Google Analytics from the server. Open Cookie settings in the footer to refuse or withdraw consent; withdrawing clears Google Analytics and Clarity cookies and reloads the page to stop both tags. Google and Microsoft may process analytics data outside your country. Microsoft may use the collected data to provide and improve its services as described in Microsoft’s privacy statement. See Google’s privacy policy.

Optional product news

If you select the separate, optional checkbox at checkout, we record your choice, its date and the wording version with your order. This permits emails about new KeyHole features, plugins and updates. The checkbox is off by default and does not affect your purchase or license delivery. You can withdraw this permission by contacting us; each product-news email will also include an unsubscribe link. Analytics consent is separate from this choice. We retain subscription preferences until withdrawn or no longer needed; minimal records may be kept to respect an unsubscribe request.

Tools

The tools under /tools run in your browser. Images you open in them are processed on your device and are not uploaded to us. When a clean export of the map and text tools is made on our servers, the settings and text you entered are sent to us to make it, and the finished file is stored for 24 hours. The first time you open your own image in Motes, your browser downloads a depth model from Hugging Face, which receives technical connection information. With your analytics permission we count tool use, such as an export finishing, but never the image, its name or its content. To export you sign in, and we keep your email address and what you export with your account. People who answered our earlier short form gave their email, where they heard about the tools and what they do for work; we keep those answers with the tool and the date. We send news only if someone ticked the separate, optional box, and every news email has an unsubscribe link. You can ask us to delete your details at any time by contacting us.

Accounts

You can sign in with a one-time link sent to your email, or with Google. With Google we receive your Google account identifier and email address, and whether Google has verified that address. We don’t receive your name, photo or Google password, and we keep no Google access tokens. We store your identifier, email, a hash of your session, your plan, credit history and payment records in order to run your account, show plugin licenses bought with the same address, prevent abuse and meet accounting duties. A session lasts up to 30 days. You can download your data or delete your account on your account page; payment records stay for as long as the law requires, without your email. Google provides sign-in, Resend sends sign-in emails, and Lava.top processes plan and credit payments. We also keep daily totals, such as how many exports were made, with no link to any person.

Service providers and transfers

Visitors connecting from Russia reach this site through bunny.net, a content delivery network, because their networks restrict the usual route. Bunny carries their requests, including sign-in cookies, and doesn’t keep them beyond its normal logs. Cloudflare hosts the site and order records. Lava processes checkout and payment information. Keygen creates license keys, and Resend sends license emails when delivery is enabled. Google Fonts receives technical connection information when loading fonts. The author portfolio is a separate site if you follow its link. These providers may process information in countries outside yours; their own notices and the applicable transfer rules also apply.

Purposes and retention

We use order data to complete purchases, deliver licenses, handle support, prevent abuse and meet applicable accounting duties. We use review data to moderate and display approved reviews with your consent. We keep order records for the period required by applicable law and operational needs; published reviews remain until removed or consent to publication is withdrawn, subject to legal obligations. We do not sell personal information or run advertising trackers on this site.

Your choices and rights

Depending on your location, you may have rights to access, correct, delete or restrict the use of your personal information, withdraw consent, or complain to a data protection authority. Email us with your request. Withdrawing permission to publish a review does not affect processing already performed lawfully.

Changes

We will update this notice when the store, payment or delivery arrangements change.