Privacy Policy

Last updated October 20, 2026

KeyGrant is a trade name of Tux Photo LLC, Oak Creek, Wisconsin, USA ("KeyGrant", "we"). This policy covers keygrant.dev, the dashboard, the API at api.keygrant.dev, the customer portal, and the SDKs and command line tool. Questions go to [email protected].

Two kinds of data

Your account. When you sign up and use the dashboard, we decide how that data is used, as this policy sets out.

Your customers. The license and device records you or your app send us belong to you. We keep them only to run KeyGrant for you. You are responsible for telling your customers about it, and you can point them to this section.

What we keep about you

Your name, email address and, if you add one, a profile photo. Profile photos and branding images are served from a public address, assets.keygrant.dev.
Your password, stored only as a salted hash (PBKDF2). Two-factor secrets and backup codes are stored encrypted.
Your teams: who belongs to which company, their roles, and pending invitations.
Which version of these terms and this policy you accepted, and when.
Your sign-in sessions: the IP address, browser, and the approximate city and country Cloudflare reports when you sign in, so you can see and end your sessions.
Your company's details as you enter them: its name, support email, time zone, postal address and branding.
Billing references from Stripe. Card details go to Stripe and never reach us.
If you link your Paddle account, the API key you paste, which we store encrypted and show only by its last four characters, and the secret of the notification setting we make there, also encrypted. Unlinking stops new sales and keeps both, so the refunds, renewals and cancellations of keys already sold still arrive, until you delete your company.

What we keep about your customers

License records: the email address the key was issued to, the buyer's email address, any note you add, and the Stripe or Paddle references and amount of the sale that created it.
Devices: a one-way hash of the machine's ID (the SDKs hash it on the device), the device name your app sends, its operating system and app version, and when it was activated and last checked in. The device record holds no IP address or location; the API log below keeps each request's IP address for 30 days.
Trials: a hashed device ID and when the trial started and was last seen.
Sign-in codes for keys locked to a buyer: stored only as a salted hash, and deleted after 24 hours.
Email records: the address, the kind of email and whether it was delivered, for every email we send your customers.
Key recovery requests: the email address asked for, deleted after 7 days.
Customer portal sign-ins: the buyer's email address, with sign-in links that last 15 minutes and sessions that last 24 hours.

Logs

The API log: each request's time, path, result and duration, the license it was for, the caller's IP address and user agent, and its request and response with license keys, leases, tokens and device IDs masked. A request or response can include a customer's email address. Kept 30 days.
The audit log of changes in your account (who did what, and when). Kept 180 days.
Webhook deliveries and what they sent. Kept 30 days.
Daily usage counts behind your charts. Kept 400 days.
Rate limiting, which counts requests per caller. Sign-in attempts are counted by IP address. The API counts by a one-way hash of the network address, email address or license key, and drops each count 2 hours after its window ends.
Product events (counts and error codes, never a license key, email address or device ID) in Cloudflare Analytics Engine, which keeps them for 3 months.

This website

keygrant.dev's public pages use Cloudflare Web Analytics to count page views. It sets no cookies and does not follow you to other sites. It is not loaded in the dashboard or on the sign-in pages. If you joined the waitlist before launch, your email address is held by Kit, our mailing list provider.

Cookies

We use cookies only to sign you in and set up your account. There are no advertising or tracking cookies.

Your sign-in session, for 7 days.
Short-lived cookies that support signing in and two-factor checks, lasting 5 to 10 minutes or until you close your browser.
"Trust this device", for 30 days, only if you choose it.
Your company name during sign-up, for 1 day, and a one-time check while you connect Stripe, for 10 minutes.
On the customer portal, your customer's sign-in session, for 24 hours.

Your light or dark theme choice is kept in your browser's local storage, and the dashboard keeps a few notes for the open tab in session storage.

Email

We send you account email: sign-in links, address checks, invitations, password resets and alerts about your account. On your behalf we send your customers their license email: keys and license files, renewals, trial endings, device limits, upgrades, added devices and uses, changes to a license's term, key recovery, sign-in codes and portal links. We send no marketing email, except to people who joined the waitlist before launch. Email is delivered through Amazon SES.

We do not sell personal data, and we do not share it for advertising. We use these providers to run KeyGrant:

Cloudflare: hosting, databases, file storage, analytics and rate limiting.
Amazon Web Services: sending email.
Stripe: billing for your KeyGrant plan. If you connect your own Stripe account, we read your sales through it to issue keys, and, when you ask from the dashboard, issue a refund or archive a price on it.
Paddle: if you link your own Paddle account, we call Paddle's API with the key you paste and receive your account's transaction, subscription, customer email address and adjustment (refund and chargeback) events, to issue keys and, when you ask from the dashboard, request a refund or archive a price on it.
Sentry: error reports when part of KeyGrant fails. They hold the error and where it happened, never request bodies, headers or IP addresses.
Kit: the waitlist from before launch.

These providers may process data in the United States and other countries.

Support access

To help with support, KeyGrant staff can open your dashboard as you, for up to an hour at a time.

How long we keep it, and deleting it

Your account data, licenses and devices are kept while your account exists, except where a period is given above. Delete your company from the dashboard's Business settings and we delete its licenses, devices, products, logs, usage, email records, audit log, members, images and portal data, disconnect its Stripe account, and delete the notification settings we made in its Paddle account. We keep its former portal addresses for 1 year, so no one else can take them over.

Closing your own sign-in removes your sessions, two-factor settings and memberships. Each company you belonged to keeps a note in its audit log that you left, for 180 days.

Your choices

You can see and change most of your data in the dashboard. To get a copy, correct something, or have something deleted, write [email protected]. If you bought a license from a developer who uses KeyGrant, ask that developer first: they control your license record, and we will help them.

Children

KeyGrant is a service for software businesses and developers. It is not meant for children.

Changes

We will post any change to this policy on this page and update the date at the top.