Privacy policy

The short version, which is also the long version’s spine: nothing you type ever leaves your Mac, and we never sell or share your personal data with anyone, for any purpose.

1. What Keycito processes on your Mac (and we never receive)

Keycito observes keyboard events for one purpose: to check, in memory, whether a keystroke matches a known shortcut in the app you’re using. It also reads the menus of the apps you choose to track, to learn which shortcuts exist, and notices when you click a menu item that had a shortcut.

What is stored — locally, in a database on your Mac that you can open yourself:

Counts of shortcut use per app per day (e.g. “⌘D in Finder, 3 times today”)
Counts of missed shortcuts (menu clicks that had a shortcut)
Your learning queue, streak, and settings

What is never stored, sent, or even assembled, anywhere:

The text you type — no key logs, no characters, no words
Per-keystroke timestamps
Window titles, document names, file paths, or screenshots

Passwords: when you type in a password field, macOS enables Secure Input, which blocks keystroke observation for all apps at the operating-system level. Keycito cannot see password entry and never attempts to work around Secure Input.

We describe this local processing here even though we never receive any of it, because “the data stays local” is a design commitment you deserve to see written down — not a loophole to avoid explaining ourselves.

2. What syncs if you join a league (opt-in)

Keycito works fully offline with no account. If you opt into leagues, we receive:

Account data: your email address (for sign-in), a display name you choose, and your league membership.
One daily score payload, exactly this — shown here verbatim and published as a schema that every release is tested against:

{ "day": "2026-07-08",
  "score_components": { "usage": 300, "diversity": 78, "learning": 40, "mastery": 0, "streak": 40 },
  "client_version": "1.2.0" }

Plus a nonce and an Ed25519 signature used to authenticate the upload. Never per-shortcut data, per-app data, per-hour data, or timestamps finer than the day. If a future update ever needed to change this payload, this page and the published schema change with it, before the update ships.

3. What we don’t do

We never sell or share your personal data with anyone, for any purpose.
No advertising trackers, no third-party analytics SDKs, no fingerprinting — in the app or on this site. Site analytics, when enabled, are cookieless and aggregate.
No dark-pattern consent flows: the app asks for exactly the OS permissions it needs, explains each one first, and works (in a reduced mode) if you decline.

4. Your rights and controls

Local data: it’s yours, on your machine. Deleting the app and its data folder removes everything; there is no server copy of your shortcut activity.
Account deletion: request it in-app or by email; we delete your account and all attached data (scores, league membership) within 30 days.
Export: you can request a copy of the account data we hold before deletion.
EU/UK users: you additionally have rights of access, rectification, portability, and objection under the GDPR; the same mailbox handles all of them within 30 days.

5. Waitlist emails

If you join the waitlist, we store your email address to send you an invite and occasional build updates. Every email has a working unsubscribe link, and unsubscribing deletes you from the list — no “preference centers,” no re-adds.

6. Age

Accounts (needed only for leagues) require you to be 16 or older. The local-only app has no age gate because it collects nothing.

7. Changes

If this policy changes materially, we’ll say so plainly on this page with a dated changelog — not bury it. The payload shown in section 2 is a standing commitment: it changes only alongside the published schema, never silently.

8. Contact

Privacy questions and requests, including deletion requests: jkdev222@gmail.com. A person reads it, usually within a day.

Keycito is currently run by its founder as an individual, not a company. The responsible legal entity will be named here when the operating company is formed, which happens before any paid features go live.