Keyey Privacy Policy

DRAFT — not legal advice; must be reviewed by a qualified lawyer before publishing.

Drafting key (remove before publishing). [PLACEHOLDER: …] is a fact to fill in. [DECISION: …] is a choice for the owner; the text around it shows the suggested default. [LAWYER: …] is a question for counsel. "Drafting notes" at the end map each statement to where it comes from (docs/PUBLIC_PLAN.md, docs/SYNC.md, the code) and list everything still open. This version describes the launch (PUBLIC_PLAN.md, the decision of 2026-10-26): one shared speech model for everyone, no personal voice training, and no user's voice leaves their device.

Effective date: [PLACEHOLDER: date]

This policy covers:

• the Keyey keyboard for Android (on Google Play, package app.keyey.keyboard);
• Keyey for Mac (downloaded from keyey.app, bundle app.keyey.desktop);
• Keyey's online services: accounts, sync, backups and Keyey Pro.

"Keyey", "we" and "us" means [PLACEHOLDER: legal name of the business, registered address, company or registration number]. [LAWYER: confirm we are the "controller" for account and billing data, and how to describe our role for end-to-end encrypted data we can't read.]

The short version

• What you type stays on your phone. The keyboard learns your words and predictions on the device. We don't receive what you type.
• Your voice never leaves your device. Speech is turned into text on your phone or Mac. We don't upload your recordings, we don't train any model on your voice, and we don't build a voice profile of you.
• Everyone gets the same speech model. It's downloaded once and runs on your device. It isn't trained on your recordings.
• Your clipboard, vocabulary and settings are end-to-end encrypted. When you sync them between your phone and Mac, they're encrypted on your device with a key only your devices have. We store them, but we can't read them.
• AI that runs on your devices. Predictions and Fix grammar on Android run on your phone, and the Android app never sends your text to an AI service. On the Mac you can choose to use Groq with your own API key: then the text you ask it to polish goes from your Mac to Groq, under your agreement with Groq (section 8).
• No ads, no selling your data, no tracking you across other apps or websites.
• You can delete everything from inside the app with Delete my account and data.

1. What stays on your device

Typing

Keyey learns how you type on your phone: your words, next-word predictions, corrections, glide typing, your shortcuts and the words you add to My words. That learning stays on the phone. We don't receive your keystrokes or what you write.

When you turn on any keyboard that didn't come with your phone, Android shows a standard warning that it "may be able to collect all the text you type". Android shows it for every such keyboard. Keyey is built so that your typing stays on the phone. The only exceptions are the things in section 2 that you choose to sync or back up, and those are end-to-end encrypted.

Smart predictions use a small language model that runs on your phone. Fix grammar (the ✦ button) and Smart dictation use a small punctuation-and-capitals model that also runs on your phone, plus a few fixed rules. Once they're downloaded, none of them sends anything anywhere.

Voice typing

Speech recognition runs on your phone or Mac, using a speech model stored on the device. When you dictate, your audio isn't sent to us or to anyone else, on any plan.

• On the phone: Voice history can keep your recent dictations: the text and, if you choose, the recording. They stay on the phone. Recordings are never uploaded and aren't included in Keyey's cloud backups; the text of your dictations is included in your encrypted backup (section 2). If you export a backup file yourself (Backup and restore › Export to a file), you choose whether recordings go in it.
• On the Mac: recent dictations keep the text, the recording, the name of the app each one went into, and which mode polished it, so you can play one or process it again. They stay on that Mac, encrypted with a key held in your Mac's Keychain, for 30 days by default (you can choose 7 or 90 days, the last 500, or forever), and they're never synced or uploaded. Transcribing an audio or video file you pick also happens on your Mac.
• Text you dictate on the Mac isn't added to your shared clipboard unless you turn on Send dictations to my phone's clipboard.
• Counting words for the free limit. The free plan includes 2,000 words of dictation a week across your phone and Mac (Keyey Pro has no limit). To apply it, the keyboard and Keyey for Mac count the words of each dictation that's written (and, on the Mac, of each file transcribed): for each one they keep when it was, how many words it had and a random ID. They never keep or send the words themselves for this. While you're signed in, each device sends those counts to our servers, which add up your account's week (your phone's and your Mac's) and tell your devices the total. We keep each count for 8 days, then delete it; Keyey counts the same on Pro, so the apps can show your week. Without an account, the count stays on the device.
• To put text where you're typing, and to rewrite text you've selected, the Mac app uses macOS's Accessibility permission. It reads the selected text and the text just before the cursor in the app in front, and it can press ⌘C or ⌘V for you. That stays on your Mac unless you use Groq (section 8). A selection Keyey copies this way isn't recorded as a clip.
• The Mac asks for the camera only to scan the pairing code your phone shows (section 2). Nothing is recorded.

Clipboard history

• On the phone, Keyey keeps what you copy only once you turn clipboard history on (it starts off, and Android asks during setup). While Keyey is your keyboard, Android lets it see what you copy in other apps; that's why it asks first.
• On the Mac, Keyey for Mac keeps what you copy in a history on that Mac, encrypted with a key in your Keychain: up to 5,000 clips on the free plan and 50,000 on Pro. Copies that password managers mark as private are never kept.
• Either way, the history stays on the device unless you share it (section 2).

Your statistics

The insights screens (typing and dictation statistics) are worked out and kept on your device. We don't receive them.

What the Android app doesn't do

The Android app on Google Play asks for one sensitive permission, the microphone, and only when you first use voice typing. It has no location, contacts or notification-reading features, no accessibility service, and it doesn't act as your phone's digital assistant.

Android's own backup

The Android app opts out of Android's automatic backup to your Google account, so none of its data is copied there. Use Keyey's own encrypted backup (section 2) or a backup file you export.

2. What syncs, end-to-end encrypted

Keyey can keep your phone and Mac in step: one clipboard, one vocabulary, the same profiles and modes. You need an account to sync (section 4). The keyboard and Keyey for Mac both work without one.

How the encryption works

• Your first device creates a random 256-bit secret key, your user key. It is never sent to our servers in a form we can read.
• To add a device, you open a pairing code (a QR code) on a device that's already set up, then scan or paste it on the new one. The code carries your key, so treat it like a password and don't share it.
• Everything listed below is encrypted on your device (AES-256-GCM) before it's sent. Only your devices can decrypt it.
• You can choose to save a recovery key. If you lose all your devices and haven't saved one, nobody can recover your synced data or backups, including us, because we never had the key.

What syncs

Passwords and codes. On Android, apps can mark something you copy as sensitive, such as a password or a one-time code. Keyey keeps and syncs these only if you tick Also save passwords and codes you copy (off unless you choose it, during setup or in You › Clipboard). On the Mac, Keyey never keeps or sends copies that password managers mark as concealed or temporary. Keyey's own pairing codes are never saved or synced on any device.

What our servers can see

We can't see the content. To deliver it, our servers handle some facts about it:

• your account, and the devices you've added: the names you give them, their type (Android or Mac), the app version, when each last connected and when each last sent a clip;
• for each clip: an ID, when it arrived, which of your devices sent it, whether it includes an image, and its encrypted size;
• for backups: when each was made, its size and its number of parts;
• for dictation (section 1): when each dictation was and how many words it had, from which kind of device (Android or Mac), to apply the free weekly limit. Never what you said;
• the internet (IP) address your devices connect from. It's part of any internet connection, is handled by our hosting provider, Cloudflare, and is used briefly to limit abuse (rate limits). We don't store it with your account or use it to work out where you are. [PLACEHOLDER: request logs: Cloudflare Workers Logs is switched on for keyey-cloud; confirm what it records (request path, status, time, error messages) and for how long (Cloudflare's retention for the plan), and say it here.]

How long synced data is kept

• Clipboard: on the free plan we keep your newest 5,000 clips and anything from the last 90 days. On Pro, the newest 50,000 clips and anything from the last 365 days. Clips outside those limits are deleted automatically, images included. [PLACEHOLDER: confirm this reading of the limits, which is how today's server works: a clip goes only once it's outside both.] You can delete one clip at any time, and deleting a shared clip on one device deletes the cloud copy. You can also erase the whole cloud clipboard. Each device keeps its own local history under its own settings (on the Mac: 5,000 clips on the free plan, 50,000 on Pro).
• Devices not seen for 90 days drop off your device list.
• Backups: on the free plan we keep your latest complete backup, up to 200 MB. On Pro, your 3 newest, up to 300 MB each. Older ones are deleted when a new one completes. A backup whose upload never finished is removed once a newer one completes, or after 7 days. [PLACEHOLDER: confirm the 7-day rule carries over from today's server to the public one.]
• Settings: each upload replaces the previous copy.

3. Your voice: what we don't collect

At launch Keyey has no voice training and no personal voice models:

• your recordings are never uploaded, on any plan;
• we don't ask about your accent, your languages, your field of work or the words you use, and we don't generate practice sentences for you;
• we don't make a "voiceprint" or anything else that could identify you by your voice;
• the speech model everyone downloads is the same one. We may improve it (a version we call Keyey Speech, tuned for technical words and newer names), but we never train it on your recordings or dictations.

If we offer personal voice models later, it will be a separate, optional feature. We'll update this policy first, and nothing will be recorded for it until you've read what it involves and agreed on its own consent screen.

4. Your account

An account is optional: you need one only to sync, back up to the cloud, use Keyey Pro, or pair your phone and Mac. You sign in with Google (Android and Mac) or Apple (Mac). We never see your Google or Apple password.

What we receive and keep:

• a unique account ID from Google or Apple;
• your email address. With Apple you can choose to share a private relay address instead;
• whether that email is verified, which we use to link a Google and an Apple sign-in that share the same verified email. You can also link them yourself from a signed-in device;
• if you sign in with Apple, a token Apple gives us, kept only so we can revoke Keyey's access to your Apple ID when you delete your account.

We don't request or store your name or profile photo.

What we keep about your devices: the name you give each device, its type, the app version, and the sign-in sessions it uses. Sessions last an hour and renew for up to 60 days. You can sign a device out, which revokes its access.

5. Payments

• Through Google Play (the only way to buy Pro at launch): you buy Pro in the Android app. It unlocks Keyey for Mac's Pro features too, because both use the same Keyey account. Google takes the payment. We receive a purchase token from the app, check it with Google, and store your plan, whether it renews and when. Google tells us when your subscription renews, changes or ends.
• [DECISION: only if web checkout is switched on later for Mac-only customers (PUBLIC_PLAN.md: "Stripe (or a merchant of record such as Paddle) comes only if Mac-only customers appear"):] On the web, through [Stripe / Paddle]: it takes the payment on its secure checkout page. We receive your subscription status, linked to your Keyey account. [PLACEHOLDER: list what else we'd store, such as the customer ID, subscription ID and email.]
• We never see or store your card number.
• Our record of your plan is deleted with your account. Google Play keeps its own record of your purchase. [LAWYER: whether we must keep any purchase records ourselves for tax or accounting, given Google Play handles the sale; if so, what and for how long.]

6. Downloads and updates

• The Android app downloads its models (the speech model, the smart-predictions model and the grammar model) only from our model server, models.keyey.app, on Cloudflare. Like any download, this reveals your device's IP address to Cloudflare.
• Keyey for Mac downloads its speech model from models.keyey.app too. Its optional polish model (Google's Gemma 4, 3–5 GB, only if you ask for it) downloads from Hugging Face, which sees your Mac's IP address like any download.
• The Android app updates through Google Play.
• Keyey for Mac checks https://models.keyey.app/mac/appcast.xml for updates once a day (the Sparkle updater). The check reveals your IP address and the app's version. Sparkle's optional system-profile reporting isn't turned on.

7. Crash reports and usage counts

The apps don't send crash reports or usage statistics today.

[PLACEHOLDER: if crash reports or opt-in usage counts are added (the plan allows "anonymous crash reports and opt-in counts"), describe them:]

• [the provider];
• [what a report contains. It must never include what you type, your clipboard, or audio];
• [whether it's opt-in];
• [how long reports are kept].

Update the Play Data safety answers too.

8. Groq, with your own key (Mac only)

On the Mac you can add your own Groq API key to polish dictation in a mode, or rewrite text you've selected, with Groq's AI models. Keyey for Mac also has an on-device polish model, and you can turn polishing off.

When a mode or a rewrite uses Groq, the text goes from your Mac directly to Groq, under your Groq account and Groq's own terms and privacy policy. It doesn't pass through our servers, and Groq isn't our service provider: it's a service you connect yourself. Your recording never goes; only the text does.

So that polished dictation fits where it's going, Keyey also sends Groq a little context, read with the Accessibility permission:

• the name of the app you're dictating into;
• a short description of the text field;
• up to 300 characters before the cursor.

Nothing is read or sent from password fields. Your Groq key stays in your Mac's Keychain; it isn't sent to us.

The Android app doesn't use Groq. It has no place to enter a Groq key and never sends your text to Groq or any other AI service.

9. Who we share data with

We don't sell your personal information or share it for advertising. We use these service providers, under contracts that only let them process data to provide their service to us [LAWYER: confirm a data processing agreement with each]:

Groq (section 8) and Hugging Face (section 6) aren't on this list: you reach them directly from your Mac, only if you choose to, and we don't send them anything.

We may also disclose information:

• if the law requires it;
• to protect people's safety;
• as part of a sale or merger of our business, in which case this policy, or one at least as protective, keeps applying [LAWYER].

We can only ever hand over what we can read. That means account details and metadata, never your end-to-end encrypted content.

10. How we protect your data

• Everything travels over encrypted connections (HTTPS/TLS).
• Clipboard, vocabulary, settings and backups are also end-to-end encrypted, as described in section 2.
• Sign-in sessions are short-lived, and you can revoke any device.
• On the Mac, the clipboard history and dictation history are encrypted at rest with keys in your Keychain.

No system is perfectly secure. If a breach affects your personal data, we'll tell you and the authorities as the law requires. [LAWYER]

11. Children

Keyey isn't meant for children. You must be at least 13 to use it, or 16 if you're in the European Economic Area or another country where 16 is the age for consenting to online services [DECISION: 13 or 16; it must match terms.md §1 and Play's target audience]. We don't knowingly collect data from children under those ages. If you think a child has given us data, contact us and we'll delete it.

12. Where your data is processed

We're based in [PLACEHOLDER: country]. Our hosting provider, Cloudflare, runs a global network. [PLACEHOLDER: where our storage and databases are located, e.g. any location or jurisdiction setting for R2 and D1; none is set in cloud/wrangler.jsonc today.]

When data moves out of the UK or the European Economic Area, we rely on [LAWYER: e.g. the EU–US Data Privacy Framework where the provider is certified, the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum].

13. Our legal reasons for using your data (EEA and UK)

14. Your rights

Everyone, wherever you live, can:

• delete their account and data from the app at any time;
• export their data with a Keyey backup file (Android: Backup and restore › Export to a file) [PLACEHOLDER: the Mac has no export of its own yet; say what it offers];
• email us with any request.

EEA and UK: you have the right to:

• access your data;
• correct it;
• delete it;
• restrict or object to how we use it;
• take it with you (portability);
• withdraw consent at any time.

You can also complain to your data protection authority. In the UK that's the ICO. [PLACEHOLDER: EU and UK representative under Article 27, if we're not established there.]

California: you have the right to:

• know what personal information we collect, use and disclose;
• delete it;
• correct it;
• not be treated differently for using these rights.

We don't sell or "share" personal information as California law defines those words, and we don't collect sensitive personal information beyond your account sign-in. An authorised agent can make a request for you. [LAWYER: whether the CCPA applies to us yet (it has revenue and volume thresholds), and the required "notice at collection".]

Other US states with privacy laws (for example Colorado, Connecticut, Texas and Virginia) give similar rights, and the right to appeal a decision we make about your request: [PLACEHOLDER: how to appeal].

We'll answer within one month (EEA and UK) or 45 days (US states). We may need to confirm it's you, usually by asking you to make the request while signed in.

15. Deleting your account

In the Android app: More › Account › Delete my account and data. [PLACEHOLDER: Keyey for Mac has no Delete my account yet (mac-notes.md §4); until it does, Mac users use keyey.app/delete-account.] On the web: keyey.app/delete-account, which works without the app. You can also email privacy@keyey.app [PLACEHOLDER: confirm this address receives mail].

What gets deleted:

• your account and its sign-ins;
• your devices and sign-in sessions;
• your plan record;
• your cloud clipboard and its images;
• your settings, vocabulary, profiles and modes;
• your dictation word counts;
• your backups.

Your account is deleted from the live service at once, and the files we stored for it straight after. If you signed in with Apple, we also revoke Keyey's access to your Apple ID. We keep only a note that an account ID was deleted and when, so the deletion can be completed. [PLACEHOLDER: timeline for copies in our provider's recovery systems, e.g. "they expire within 30 days" (Cloudflare D1's point-in-time recovery keeps up to 30 days); a request by email or on the web is handled within 30 days (site/config.json, deletionDays). Keep the two the same.]

What doesn't get deleted automatically:

• A Google Play subscription isn't cancelled by deleting your account. Cancel it in Google Play first, or you may keep being charged. [DECISION: if web checkout is added, whether deleting the account cancels a web subscription automatically; suggested: yes.]
• What's still on your devices: local history, dictations, the typing model and the speech model. These go when you remove the app. [DECISION: add "Erase this device" in the apps]

16. How long we keep things, at a glance

17. Changes to this policy

If we change this policy, we'll update the date at the top. For important changes, for example if we ever offer personal voice models, we'll tell you in the app before the change takes effect and, where the law requires, ask for your consent.

18. Contact us

privacy@keyey.app [PLACEHOLDER: confirm it receives mail] · [PLACEHOLDER: postal address] · [PLACEHOLDER: data protection officer, if one is required]

Drafting notes (remove before publishing)

Sources for each statement

• The launch scope (one shared speech model, no per-user training, no user's voice leaves their device): PUBLIC_PLAN.md, the launch decision of 2026-10-26. The plans (the owner's decision of the same day, PUBLIC_PLAN.md "The product"): Free dictates 2,000 words a week across the phone and the Mac (one allowance per account) and syncs My words between phone and Mac; Pro adds unlimited dictation on both, one clipboard across phone and Mac, the bigger history (50,000 clips) and bigger backups. In the app: Edition.personalModels is off in src/public/…/Flavor.kt (no consent, voice profile, reading or uploads; AppGraph.voiceUploads).
• No Groq on Android: PUBLIC_PLAN.md item 4; Edition.groq is off in the public flavour, so the app has no key entry, styles, Ask, Write for me, Groq Smart dictation, Reply ideas or daily read, and GroqClient refuses every request (app/src/testPublic/…/ime/NoGroqTest.kt, …/ui/NoGroqScreensTest.kt).
• Groq on the Mac with the user's own key, the context sent (app, field, up to 300 characters before the cursor, nothing from secure fields): mac/Sources/KeyeyClipboardKit/TextTarget.swift (smartTarget, maxBefore = 300); the key in the Keychain: mac/README.md.
• On-device models: smart predictions (docs/SMART_PREDICTIONS.md), Fix grammar and Smart dictation's tidy-up (docs/LOCAL_POLISH.md; OnDevicePolish makes no network calls). Model sources: PolishModelManager.PUBLIC_BASE, BuildConfig.MODELS_URL and VOICE_MODEL_URL (models.keyey.app) in app/build.gradle.kts; the Mac's speech model from models.keyey.app (mac/README.md, "The public build"), its polish model from Hugging Face (mac/Sources/KeyeyClipboardKit/LocalModel.swift); the Sparkle feed in mac/Resources/Info-public.plist (SUEnableSystemProfiling isn't set, so it's off).
• The public Android manifest (no location, contacts, notification listener, assistant, self-updater; allowBackup="false"): app/src/public/AndroidManifest.xml.
• Clipboard history and passwords-and-codes off until chosen: Flavor.clipboardHistoryByDefault = false, sensitiveClipsByDefault = false, and the onboarding's clipboard step (src/public/…/OnboardingScreen.kt).
• Mac dictation history (text, recording, app, mode; Keychain-sealed; 30 days by default; never synced): mac/Sources/KeyeyVoice/DictationHistory.swift, mac/README.md "Recent dictations". The camera, only to scan the pairing code: NSCameraUsageDescription in Info-public.plist.
• Mac plan gating (Free: dictation, modes, a 5,000-clip history, no clipboard sync; Pro: sync and 50,000 clips): mac/README.md "The public build"; AccountController.swift (setSyncBlocked, historyCap). Vocabulary, profiles, modes and the AI settings sync on any plan there.
• The weekly word count (section 1, section 2's server list, section 16): cloud/src/usage.ts and cloud/migrations/0002_word_usage.sql (word_usage: user, entry ID, time, words, android/mac, received; pruned after 8 days by each upload and the daily cron; deleted with the account in deleteMe); the apps keep their own entries (app/…/voice/DictationWords.kt in its own preferences file, in no backup; mac/…/WordAllowance.swift in the Mac's defaults, not in backups). Both count the text that was written, never send it.
• User key, pairing code, recovery key, AES-256-GCM: PUBLIC_PLAN.md, "End-to-end encryption"; SYNC.md.
• Clip retention (5,000/90 days and 50,000/365 days) and backup caps (Free 1 × 200 MB, Pro 3 × 300 MB): PUBLIC_PLAN.md, "Per-user API" and "Payments and entitlements".
• Account data (account ID, email, verified flag; the Apple refresh token kept only to revoke; no name or photo), IP used as the rate-limit key, deletion (D1 rows at once, the Durable Object at once, the R2 prefix right after, a deletions row kept): cloud/src/auth.ts (clientIp, deleteMe); cloud/wrangler.jsonc (observability on).
• Sessions: 1 hour, 60-day refresh, revocable devices: PUBLIC_PLAN.md, "Identity and sessions".
• Play purchase token, Google Play Developer API and RTDN; Stripe stays switched off at launch: PUBLIC_PLAN.md, "Payments and entitlements"; cloud/src/billing.ts.
• Cloud backups leave voice recordings out and include transcripts: app/…/backup/BackupManager.kt (includeVoiceAudio = false).

Removed from the earlier draft, because they don't apply at launch: Pro voice training (what's recorded, the setup answers, practice sentences from an LLM provider, the trainer, Modal, the voice key sealed for the trainer, retention and deletion of recordings, staff access), biometric-privacy and Washington consumer-health notes, the "help improve Keyey" opt-in, "Learn from my dictations", the optional Android features the public build doesn't have (location, contacts, Reply ideas, the assistant), Android's own backup, and Groq on Android. They come back, with voice-training-consent.md, if personal models are switched on.

Still open in this file:

• [PLACEHOLDER]: effective date; the legal entity, address and country; request logs and their retention; the clip-retention reading and the 7-day rule for unfinished backups; crash reporting (if added); the email or support provider; data location; the Mac's export and Delete my account; the deletion timeline in providers' recovery systems; that privacy@keyey.app receives mail; the postal address and any data protection officer; how US users appeal; an EU/UK representative.
• [DECISION]: the minimum age (13 or 16); web checkout and its provider, and whether deleting the account cancels a web subscription; "Erase this device".
• [LAWYER]: our role as controller; purchase records we must keep; processing agreements; disclosure in a sale or merger; breach notice; transfer mechanisms; legal bases; whether the CCPA applies and its notice at collection.

This page is rendered from docs/legal/privacy-policy.md. Questions: privacy@keyey.app.