Privacy Policy

1. Who we are

The company responsible for your personal information (the "controller" under EU law) is Five Key LLC, a company based in the United States.

You can reach us about anything in this policy at [email protected].

2. What we collect

Our website

Our website is a simple static site. It has no cookies, no analytics, no ads, no tracking, no forms and no JavaScript. We don't collect personal information through it.

Like any website, it runs on servers operated by a hosting provider. When your browser requests a page, the host's servers handle basic technical information, such as your IP address, browser type (user agent) and the page requested. The host may keep this in standard server logs for a short time to deliver the site and protect it against abuse and attacks. We don't use this information to identify or track visitors.

Our apps

Our apps don't collect personal information. Specifically, our apps:

• don't ask for your name, email address or any other personal details;
• don't require or offer accounts or sign-in;
• don't include ads;
• don't include third-party analytics, advertising or tracking tools (SDKs);
• don't collect persistent identifiers (such as advertising IDs or device IDs) for advertising, analytics or tracking;
• don't send personal information to us or to anyone else.

Any settings or progress an app saves stay on your device. Deleting the app deletes them.

When you download or buy an app from the Apple App Store, Apple handles that under its own privacy policy. We don't receive personal information about you from Apple.

Emails you send us

If you email us, we receive your email address, your name if you include it, and whatever you write. We use this only to read and answer your message.

Your email passes through and is stored by the email service providers we use to receive and manage our mail. They handle it only to deliver and store our mail for us. We may also use automated tools to help sort messages and draft replies.

We keep emails only as long as we need them to handle your request, and we delete them within 12 months after the conversation ends, unless we need to keep a message longer to meet a legal obligation or resolve a dispute. If you ask us to delete your emails sooner, we will.

Please don't send us personal details about a child.

3. What we don't do

• We don't use cookies, web beacons or similar technologies.
• We don't use analytics or advertising services.
• We don't show ads, and we don't track you across other apps or websites.
• We don't sell personal information, and we don't share it for cross-context behavioral advertising (as those terms are used in California law).
• We don't buy personal information or obtain it from data brokers, and we don't provide it to data brokers.
• We don't make decisions about you based solely on automated processing, including profiling.

We disclose personal information only to the service providers who help us run our email and website, as described above, or if the law requires it (for example, a valid court order).

4. Children's privacy

Some of our apps are made for young children and will be offered in the App Store's Kids category. We take extra care with them.

What our kids' apps collect: nothing. Our kids' apps don't collect, use or disclose personal information from children, including children under 13. They don't collect persistent identifiers for advertising, analytics or any other purpose, and they contain no ads, no third-party analytics and no third-party advertising. Our kids' apps have no in-app purchases.

Grown-up areas will be gated. Our children's apps will place any link that leaves the app, any purchase and any settings meant for adults behind a parental gate: a short task designed for adults, so children can't reach them by accident.

United States (COPPA). We design our kids' apps to meet the Children's Online Privacy Protection Act and the FTC's COPPA Rule, as amended in 2025. Because our kids' apps don't collect personal information from children, there's nothing to share, sell or keep, and nothing that requires parental consent. If we ever change a kids' app in a way that would collect personal information from children, we will update this policy first and get verifiable parental consent where the law requires it.

If a parent emails us, we use the message only to reply, and we treat it like any other email (see "Emails you send us"). If we learn that a child has emailed us, we will use the child's email address only to reply once, if appropriate, and then delete it.

Parents can contact us at any time at [email protected] to ask what information we have, if any, about them or their child, and to have it deleted.

European Union and Italy. Under the EU General Data Protection Regulation (GDPR), Article 8, a child under a certain age can't give their own consent to online services; a parent must. In Italy that age is 14 (Italian Privacy Code, Article 2-quinquies, added by Legislative Decree 101/2018). Our apps don't process children's personal data on the basis of consent, or at all, so no consent from a child or a parent is asked for or needed.

5. For people in the EU and Italy (GDPR)

Legal bases

We process personal information only on these legal bases under GDPR Article 6(1)(f), "legitimate interests":

• Answering your emails. It's in your interest and ours that we can reply when you contact us.
• Website security logs. It's in our interest, and our visitors', that the website is delivered reliably and protected against abuse.

We don't rely on consent for any processing, and we don't process special categories of data (such as health data).

Your rights

You have the right to:

• access the personal information we hold about you;
• rectification, to have inaccurate information corrected;
• erasure, to have your information deleted;
• restriction, to have us limit how we use your information;
• objection, to object to processing based on legitimate interests;
• portability, to receive information you gave us in a usable format;
• complain to a supervisory authority. In Italy, that's the Garante per la protezione dei dati personali (www.garanteprivacy.it). You can also complain to the authority in the EU country where you live or work, or where you think a problem happened.

To use any of these rights, email [email protected].

International transfers

Five Key LLC is based in the United States, and so are some of our service providers. If you email us from the EU, your message will be transferred to and handled in the United States. We rely on the safeguards the GDPR allows for such transfers, and we keep the information we receive to a minimum.

Retention

See "Emails you send us" for how long we keep emails. Our apps keep no personal information; their settings stay on your device. Website server logs are kept by our host for a short time under its own policies.

Automated decisions

We don't make decisions about you based solely on automated processing, including profiling.

6. For people in U.S. states with privacy laws

Several U.S. states, including California (CCPA, as amended by the CPRA), give residents rights over their personal information. These laws may not apply to a company of our size, but we offer these rights to everyone anyway:

• the right to know what personal information we have about you and how we use it;
• the right to delete it;
• the right to correct it;
• the right to opt out of the sale or sharing of personal information, and of targeted advertising.

Do Not Sell or Share My Personal Information. We don't sell or share personal information, and we don't use it for targeted advertising or profiling, so there is nothing to opt out of. If that ever changes, we will update this policy first and give you a way to opt out.

Global Privacy Control. We honor Global Privacy Control (GPC) and similar browser opt-out signals as a request to opt out of sale and sharing. Since we don't sell, share or track, our website and apps already behave as if every visitor had opted out.

We won't treat you differently for using any of these rights. To make a request, email [email protected]. You may use an authorized agent; we may ask for reasonable proof that they act for you.

7. Security

We keep the information we hold to a minimum, which is the strongest protection there is. For what we do hold, mainly emails, we use reputable providers, keep access limited, and use reasonable technical and organizational safeguards. No system is perfectly secure, but we work to protect what you send us.

8. Making a request

To ask for access, correction or deletion, or to use any other right in this policy, email [email protected]. We may need to confirm the request comes from you, usually just by replying from the same email address.

We will respond within 30 days. For requests under the GDPR, we will respond within one month, which the GDPR allows us to extend in some cases; if we need to, we'll tell you why.

9. Changes to this policy

If we change this policy, we will post the new version on this page and update the effective date at the top.

If a change materially affects how one of our apps handles information, we will give notice before it takes effect, in the app's release notes or on our website. We will never begin collecting personal information from children without first updating this policy and getting verifiable parental consent where the law requires it.

10. Contact

Questions about privacy? Email [email protected].