KeyFlow Information

1. Information We Collect

• Personal Data: Email address (via Auth providers), First/Last name, Profile picture.
• Usage Data: IP address, browser type, pages visited, and time spent on the Service.
• Sign in with Apple: The email address Apple shares (a relay address if you use Hide My Email) and your name if you choose to share it.
• Mobile App: Device model, operating system and app version, in-app usage events (Firebase Analytics), crash and diagnostic data (Firebase Crashlytics), and a device token for push notifications.
• Two-Step Verification: Your authenticator (TOTP) secret stored encrypted, passkey public keys and device names, hashed recovery codes, and connected device records. Passkey private keys and biometric data stay on your device and are never collected.
• Reports: The reported content or user, the reason, any details you enter, and the time of the report.

2. Use of Data

• To provide and maintain the Service.
• To notify you about changes and provide customer support.
• To analyze usage patterns for service improvement.
• To detect and prevent technical issues and fraudulent activities.
• To provide account protection such as two-step verification.
• To diagnose app errors, improve stability, and send push notifications.
• To review reports, act on policy violations, and keep the community safe.

3. Retention and Destruction of Data

• We retain your personal data only for as long as your account is active or as needed to provide the Service.
• Abuse Prevention: We may retain encrypted identification data (e.g., email hash) for 90 days after withdrawal to prevent fraudulent re-registration.
• Account Deactivation: During deactivation, data is securely stored but not publicly exposed until reactivation or permanent deletion.
• Records required by law (e.g., transaction records) may be stored for the period defined by applicable statutes.

4. Service Providers (Data Entrustment)

We employ third-party providers to facilitate our Service. Some of these providers may process data outside your country of residence:

• Google Firebase: Authentication and Database services.
• Vercel: Hosting and deployment.
• Google Analytics / Aptabase: Usage tracking and analytics.
• OpenAI / Anthropic / Google Gemini: AI-based content generation and assistance.
• Resend: Email transport service.
• Google Firebase (Analytics, Crashlytics, Cloud Messaging): Mobile app usage analytics, crash diagnostics, and push notification delivery (United States).
• Functional Software, Inc. (Sentry): Error monitoring and session replay with on-screen text, inputs, and media masked (United States).

5. Your Data Rights

You have the right to access, correct, or delete your personal data. You can exercise these rights through your account settings or by contacting us directly.

• Deleting your account in the app: Choose “Delete account” in the app settings to delete your account without visiting the website. You must sign in again right before deletion, and complete two-step verification if it is enabled.
• What is deleted: Your profile, posts and comments, two-step verification data (secret, passkey public keys, recovery code hashes), connected devices, and block list. Data retained under Section 3 is destroyed when its retention period ends.
• Reports and blocks: You can report or block posts, threads, comments, and other users. Reports are used only to review policy violations, and reporters are not disclosed to the reported user.

6. Data Security

We implement commercially reasonable security measures to protect your data. However, please note that no method of transmission over the internet is 100% secure.

7. Contact Information

If you have any questions, please contact our Data Protection Officer at: