This privacy policy explains how Keyholdr.app ("we", "us", "our") processes personal data when you use our chastity management app (the "Services"). Keyholdr.app is the data controller. Contact us at support@keyholdr.app for privacy queries; a postal address is available on request to this email.
Data We Collect
We collect these categories of personal data:
- Account data: email, username, password (hashed), profile information.
- Usage data: feature interactions, in-app actions, timestamps, logs.
- Device/technical data: IP address, device type, OS, browser, app version, crash logs, approximate country derived from IP.
- Communication data: chats, support emails, feature requests, bug reports.
- User content: uploaded photos, notes, settings, preferences.
- Special category data: information about sex life, collected through normal app use and user inputs.
We collect no data from third parties. Data comes directly from you (registration, settings, support), automatically via app usage, cookies (for sessions, preferences, analytics), Firebase services, and self-hosted analytics.
How and Why We Process Data
We process data for the following purposes, with typical legal bases under GDPR:
- Provide and operate the app, manage accounts, support users: performance of contract.
- Security, abuse prevention: legitimate interests.
- Analytics and service improvement: legitimate interests.
- Marketing emails/newsletters/service updates: consent (you may opt out via in-app toggle or email unsubscribe).
- Legal compliance: legal obligation.
Special category data (information about sex life) is processed only with your explicit consent provided at registration or via an in-app consent flow.
Sharing and Transfers
We share data only with processors under contract, including:
- Firebase
- Google services (analytics)
- Cloudflare (infrastructure)
- SMTP2GO (email delivery)
These services may store or process data on servers located outside the UK/EEA (for example, in the United States). We rely on our providers' standard contractual clauses / data processing agreements to provide safeguards for such transfers.
Retention Periods
- Account data: retained while the account is active; deleted after 90 days of inactivity.
- Logs and analytics: retained for 1 year.
- Backups: retained for 90 days.
- Communications: retained until account deletion/inactivity.
- Transaction records: retained for 6 years (legal requirement).
We delete or anonymise data when it is no longer needed for the purposes described above.
Security Measures
We implement appropriate technical and organisational measures in line with GDPR Article 32, including HTTPS/TLS in transit, encryption at rest (Firebase), access controls and role-based access, and regular backups and software updates.
Your Rights
You have the following rights under GDPR: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection, and withdrawal of consent. We do not make automated decisions with legal effect. To exercise your rights contact support@keyholdr.app. We will verify identity and respond within one month where required by law. Account deletion is available in-app; data export requests can be made by email.
Opt-Out of Marketing
You may opt out of marketing communications at any time via in-app settings or by using the unsubscribe link in marketing emails.
Cookies and Tracking
We use cookies and similar technologies for login sessions, preferences, and analytics. Manage cookie preferences via your browser or app settings.
Age Restrictions
The Services are intended for users aged 18 or older. We do not knowingly collect personal data from children under 18. Age confirmation is requested during registration via a checkbox.
Policy Updates
We may update this privacy policy from time to time; the "Last updated" date at the top will reflect material changes. We will notify material changes in-app and/or by email where appropriate.
Complaints
If you have concerns about our processing of your personal data, contact support@keyholdr.app. You also have the right to lodge a complaint with your local data protection authority.