LocalGateKeys Privacy Policy

Effective date: 19 October 2026

This policy explains what personal data Ilias Pelekas, 05-300 Mińsk Mazowiecki, Poland ("we", "us") processes in connection with the LocalGateKeys software, the website at localgatekeys.app and Pro purchases. We are the controller for the processing described here, except where we say another company is.

1. Summary

• The apps collect nothing. The LocalGateKeys Windows app, browser extension, local browser helper and iPhone app do not send us your vault, usage data, crash reports, analytics or identifiers. There is no account.
• The website sets no cookies and uses no analytics, trackers, third-party scripts or third-party fonts.
• Payments are handled by Paddle, our merchant of record. We never see your card details.
• Our servers only see ordinary connection data when the app checks for updates or downloads the licence revocation list, and you can turn both off with Strict offline mode.

2. The apps

2.1 Your vault

Your vault, attachments, backups and settings are stored on your devices. They are encrypted with keys derived from your master password, which never leaves your device. We do not receive, store or have any way to access them.

2.2 No telemetry

The apps contain no telemetry, analytics, advertising identifiers or automatic crash reporting. Error logs are written only to your own device. If you choose to email us a log, we process what you send as described in section 6.

2.3 Browser extension

The extension communicates only with the LocalGateKeys app on the same computer, through a local helper program. It does not send page content, browsing history or logins to us or to anyone else. The Chrome Web Store and Microsoft Edge Add-ons may process data about installations under their own privacy policies.

2.4 Sync (Pro)

• Over your home network, your devices connect to each other directly. The data they exchange is encrypted end to end and does not pass through us.
• Through your own cloud folder, the app writes encrypted files to a folder on your device, and your cloud-drive provider (for example Microsoft OneDrive, Dropbox, Google Drive or Proton Drive) uploads them. Your provider can see that the files exist, their size and when they change, but not their contents. Your agreement with that provider governs its processing. We do not receive these files.

3. Network requests the app makes to us

The app contacts our update service at updates.localgatekeys.app in only two cases. Strict offline mode in Settings stops both.

3.1 Update checks

When you choose Check for updates (or accept the app's offer to check after a long time offline), the app downloads one small signed file describing the latest version. The request contains:

• your IP address, as for any internet connection;
• the time of the request;
• the address of the file requested;
• the app's user agent, in the form LocalGateKeys/<version>, which tells us the version you use.

It contains no account, licence, device or vault identifier, and no cookie. The app does not download or install anything else unless you choose to, in your browser.

3.2 Licence revocation list

Together with each update check, the app downloads a signed list of revoked licences and checks your licence against it on your device. The request contains the same connection data as an update check and nothing about your licence. We therefore cannot tell from it which licence, or which customer, made the request.

3.3 Who processes this data and for how long

The update service is hosted by Cloudflare, Inc. as our processor. Cloudflare processes connection data to deliver the files and protect the service from abuse, under its data processing addendum. We do not keep our own logs of these requests, and we do not combine them with order data. Cloudflare's own retention of security logs is described in its privacy policy.

Legal basis (where the GDPR applies): our legitimate interest in delivering updates and the revocation list securely (Article 6(1)(f) GDPR), and performing our contract with Pro customers (Article 6(1)(b)).

4. This website

The website is a set of static pages hosted on Cloudflare Pages. It sets no cookies and uses no analytics, advertising, tracking pixels, social media plugins, third-party scripts or externally hosted fonts.

When you visit, Cloudflare, Inc. processes your IP address, browser user agent, the pages you request and the time, as our processor, in order to deliver the pages and protect the site against attacks. We do not use this data to identify or profile visitors. Legal basis: legitimate interests (Article 6(1)(f) GDPR).

Links to the Microsoft Store, Chrome Web Store, Edge Add-ons, App Store and Paddle take you to other companies' websites, which have their own privacy policies.

5. Purchases

5.1 The merchant of record

Pro is sold by Paddle, which acts as the reseller and merchant of record. Paddle collects your payment details, billing information and tax information, processes the payment, calculates and remits tax and issues receipts and invoices. It is the controller of that data under its own privacy policy: https://www.paddle.com/legal/privacy. We never receive your full card or bank details.

5.2 What we receive

To issue and support your licence, Paddle gives us:

• your name and email address;
• your country (and postcode, where required for tax);
• your order number, product, price, tax, currency and date;
• your VAT ID, if you entered one;
• refund and chargeback status.

We use this data to generate and send your Licence File, resend it if you lose it, answer your questions, process refunds and revocations, prevent fraud and keep the records required by tax and accounting law.

Legal bases: performance of a contract (Article 6(1)(b) GDPR), legal obligations (Article 6(1)(c)) and legitimate interests in preventing fraud (Article 6(1)(f)).

5.3 The Licence File

Your licence contains a random licence ID, the edition, your name, your email address and the date it was issued, signed by us. Your name and email are included so that a licence can be traced to its buyer if it is shared. The licence is stored on your devices (also inside your encrypted vault) and checked there. The app never sends it to us.

5.4 Issuing and retrieving your licence

After payment, Paddle notifies our licence service, which runs on Cloudflare Workers. The service asks Paddle for your name and email address, creates your licence, and stores it in Cloudflare's key-value storage under a random link that only your browser knows, so the page you are sent to after checkout can show it. We keep issued licences there for 10 years so we can show or resend them, and an index from your order number to the licence so the same order is never issued twice.

5.5 Retention

We keep order records for 5 years from the end of the calendar year in which the tax for the order became due, as required by tax and accounting law, and then delete them. Revoked licence IDs stay on the revocation list for as long as the licence could otherwise be used; the list contains licence IDs only, not names or email addresses.

6. Support emails

If you email us, we process your email address, your message and anything you attach, in order to answer you. The email is processed by our email provider as our processor. We keep support emails for 2 years after the conversation ends. Please never send your master password, recovery phrase, vault file or unencrypted backups.

Legal basis: legitimate interests in answering your request (Article 6(1)(f) GDPR), or performance of a contract if you are a customer (Article 6(1)(b)).

7. iPhone app

7.1 The LocalGateKeys iPhone app, when released, collects no data. Its App Store privacy label is "Data Not Collected". It syncs only with your own Windows PC, over your own network, or through your own cloud folder.

7.2 Apple processes data about your App Store download and purchases under Apple's privacy policy. We receive only aggregated, non-identifying download and sales reports from Apple.

7.3 If you choose to share analytics with app developers in your iPhone settings, Apple may provide us with crash reports that do not identify you. We use them only to fix bugs.

8. Sharing

We do not sell or rent personal data, and we do not share it for advertising. We share it only with:

• Paddle, for orders and refunds;
• Cloudflare, Inc., which hosts the website, the update service and the licence service;
• our email provider, for support;
• professional advisers and authorities, where required by law.

9. International transfers

Cloudflare, Paddle and our email provider may process data outside your country, including in the United States. Where the GDPR applies, these transfers are protected by an adequacy decision (such as the EU-US Data Privacy Framework, where the recipient is certified) or by the European Commission's standard contractual clauses.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. To exercise these rights, email privacy@localgatekeys.app. We may ask you to confirm you control the email address on an order.

Because the apps do not send us your vault or usage data, we hold no such data to give you, correct or delete. Your vault is under your control on your devices.

You have the right to complain to a data protection supervisory authority, in particular in the country where you live or work. Our lead authority is the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

11. Children

LocalGateKeys is not directed at children under 16, and we do not knowingly sell to them.

12. Security

We protect the data we hold (order records and support email) with access control and two-factor authentication on the accounts that store it. Licence files and update manifests are signed with keys that are not stored on the servers that publish them.

13. Changes

We will post any changes to this policy on this page and update the effective date. If a change affects what the apps send, we will also describe it in the release notes before that version is released.

14. Contact

Ilias Pelekas, 05-300 Mińsk Mazowiecki, Poland. Privacy questions: privacy@localgatekeys.app.