Privacy policy
Last updated: 5 October 2026
This explains what personal data KeyAuth handles, why, and what your rights are. It follows the EU General Data Protection Regulation (GDPR) and Spanish data protection law.
1. Who is responsible
For developers (people with a KeyAuth account), Ekisde, [email protected], is the controller.
For the customers and resellers of a developer, the developer is the controller and we are the processor, acting for the developer. If you are a customer of a program that uses KeyAuth, contact the developer first about your data; we will help them answer you.
2. What we collect and why
| Who | Data | Why | Basis |
|---|---|---|---|
| Developers | Email, username, password (stored only as a one-way hash), two-factor secret (stored encrypted) and recovery codes (stored hashed), sign-in times, the IP address of sign-ins and security events, email confirmation date. | To run your account and keep it secure. | Contract; our legitimate interest in security. |
| Developers | Your applications, levels, products, license keys, variables and files; your activity log. | To provide the service. | Contract. |
| Developers who pay | Stripe customer and subscription identifiers, plan status and period end. Card details go to Stripe only. | To give you the plan you paid for. | Contract; legal obligation (invoicing and tax). |
| Developers who ask for higher limits | The text of your request. | To decide it. | Your request (pre-contract). |
| Customers of a developer | Username, password (hash only), the identifier of the device the software runs on, last IP address, last sign-in time, subscription levels and expiry, ban status and reason, the licence key they used, and a history of their activity in the application (sign-ups, sign-ins, failed sign-ins with the name tried, redeemed keys, blocked attempts), each with an IP address. | For the developer, to check licenses and sign customers in. | Set by the developer (usually contract). |
| Resellers of a developer | Username, password (hash only), credit balance, sign-in time, the keys they made. | For the developer, to let resellers make keys. | Set by the developer. |
| Everyone | IP addresses and usernames in short-lived counters that limit repeated attempts; error logs. | To block abuse and keep the service working. | Legitimate interest in security. |
We do not sell personal data, show ads, or use analytics or tracking tools.
3. Cookies
KeyAuth sets one cookie, which keeps you signed in. It is strictly necessary for the service, expires with your session, and is not used for tracking, so no consent banner is needed. When you create an account, a challenge from Cloudflare (Turnstile) checks that you are a person, and it may process technical details of your browser to do so. Stripe's payment pages are run by Stripe under its own policies.
4. Who receives data
- Cloudflare carries the traffic to our server and runs the sign-up check.
- Stripe processes payments for paid plans.
- Our server, including its email system, which sends confirmation and notice emails.
- Authorities, if the law requires it.
Some of these providers may process data outside the European Economic Area. Where that happens it relies on safeguards the law accepts, such as standard contractual clauses or an adequacy decision.
5. How long we keep it
- Account data: while your account exists. When you delete your account (Security → Delete account) or ask us to, we delete it right away, except what we must keep by law (for example payment records for tax purposes, which Stripe also holds).
- Customers' and resellers' data: while the developer's application exists, or until the developer deletes it.
- Client sessions: about an hour. Attempt counters: a short time after their window ends. The history of your customers' activity in an application: 90 days.
- Activity log: while the application or account exists. When the account is deleted, the entries stay only as anonymous events: names, details and IP addresses are removed.
- Backups: copies of the database are made when we update the service and are deleted automatically after about 30 days (the 10 most recent are always kept). Data you delete can remain in a backup until then.
6. Security
Passwords are hashed with Argon2. Two-factor secrets and application signing keys are encrypted. Access is over HTTPS only, and each developer's data is separated from the others'. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
7. Your rights
You can ask to see your data, correct it, delete it, receive a copy, restrict or object to some uses of it, and withdraw consent where we rely on it. Email [email protected] from your account's address. You can delete your account yourself under Security → Delete account, or ask us by email. You may also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos.
8. Changes
We will update this page if what we do changes. The date at the top shows the latest version.