Privacy policy

Last updated September 28, 2026

This policy explains what Keychain.plus collects through this website and the Keychain.plus desktop app, why, and who else handles it. Keychain.plus, based in Florida, USA, is responsible for this data. We don't ask for your name or email to create an account.

What we collect

• Account. Your account number in hashed form, when you created the account, and your sign-in sessions.
• Purchases. Order details: hours bought, amount, payment status, refunds, disputes, dates, and Stripe's payment reference. Stripe collects your payment details under its own privacy policy. We never see your card number.
• App keys and usage. Your app keys in hashed form, when each was activated and expires, an identifier for the computer that activated it, and for each model request the model, time, and tokens used.
• Prompts and files. The desktop app stores your conversations and projects on your computer. When you send a message, the app sends it with the conversation so far and any files, search results, or command output you allow. Our servers pass this to our AI model supplier and return the reply. We don't store the content of your prompts, files, or replies.
• Contact messages. Your name if given, your email address, the topic, and your message.
• Technical data. Your IP address and browser details when you connect.

Why we use it

We use this data to provide the service you bought, process payments and refunds, answer you, apply limits, plan capacity and pricing, prevent fraud and abuse, and meet legal duties. Where the law asks for a legal basis, we rely on our contract with you, our legitimate interest in running and protecting the service, and our legal obligations.

Cookies

We use one cookie to keep you signed in for up to 7 days. We use no advertising, analytics, or tracking cookies, and we don't track you across other sites, so we don't respond to Do Not Track signals.

Who handles your data

• Cloudflare hosts the website, API, and database, and keeps short-lived request logs.
• Stripe processes payments.
• Our AI model supplier and its model providers process your prompts and files to produce replies, and may keep them under their own terms.
• Our email provider stores contact messages.

We don't sell your personal information or share it for advertising. We may disclose data when the law requires it or to prevent fraud or abuse. If the service is sold or reorganized, data may transfer to the new owner. These providers may process data in the United States and other countries. For data from the EU or UK, we rely on their standard contractual clauses or similar safeguards.

Don't send secrets, such as passwords or keys, that you wouldn't share with a third party.

How long we keep it

We keep account, key, order, and usage records while your account exists, and after that as long as we need them for legal, tax, accounting, or fraud-prevention reasons. We keep contact messages as long as needed to handle your request. Sign-in sessions expire after 7 days.

Your rights

You can ask to access, correct, delete, or get a copy of your data, or object to or restrict how we use it. Send requests through the contact form, and don't include your account number or app key. We'll need to confirm the account is yours, and we may keep records the law requires. If you're in the EU or UK, you can also complain to your local data protection authority. We won't treat you differently for using these rights.

Security

We use reasonable measures to protect your data, but no system is perfectly secure. Keep your account number and app key private.

Children

The service is for people 18 and older. We don't knowingly collect data from children. If you believe a child has given us data, contact us and we'll delete it.

Changes

We'll update the date at the top when this policy changes, and post a notice on the website for significant changes.

Contact

Privacy questions or requests go through the contact form.