Privacy policy

Last updated 9 September 2026

Kiiwi listens for keys so it can play a sound. It never learns what you type. This page says exactly what is sent, by which part, and to whom.

The app

Keystrokes

Kiiwi uses macOS Accessibility permission to observe key events system-wide. A key event is read only to decide which recording to play, then discarded. It is never written to disk, never buffered, and never transmitted. There is no keystroke log to hand over, subpoena or leak, because there is nowhere one is kept.

Activation, and the licence check

Kiiwi keeps track of whether its licence is still valid, because that is what lets it run at all. It checks when you activate, each time it launches, and once a day while it is running. Each check sends four things to our activation endpoint:

• Your licence key.
• The id of the seat this Mac holds, so the check confirms this machine's activation rather than only that the key exists somewhere.
• A SHA-256 hash of your Mac's hardware identifier (IOPlatformUUID). The raw identifier never leaves the machine. The hash names the activation so seats can be counted, and cannot be reversed into anything about you or your Mac.
• The app version, so a support email can be answered accurately.

That is the whole of it. The check carries no usage data, no file names, no keystrokes and no identifier for you as a person: it answers one question, which is whether this Mac's seat is still good.

The endpoint relays it to our payment provider, who hold the licence and its activation count, and the result is cached on your Mac so it keeps working offline for 14 days before asking for a connection.

What the app does not do

No analytics, no telemetry, no crash reporting, no advertising identifiers, no update ping you did not ask for, and no account to create.

This website

The keystroke counter

The playground counts how many keys have been pressed on the page. Your own running total is kept in your browser's localStorage, which never leaves your device. A single site-wide total is incremented in Google Firestore. That number is an aggregate count and carries nothing that identifies you: not which keys, not a session id, not an account.

Cookies and analytics

None. No cookies are set, no analytics or tag manager is loaded, and nothing follows you off this site.

Third parties who see your IP address

Loading any web page reveals your IP address to whoever serves it. For this site that is:

• Vercel, who host the site and its two small endpoints.
• Google (gstatic.com, Firestore), for the counter library and the counter itself.
• Amazon CloudFront, which serves the background video.

Fonts are served from this site, not from a font CDN, so no third party sees you through them.

Buying

Checkout runs on Dodo Payments, the merchant of record. They collect your name, email, billing details and whatever their tax obligations require, and they process the payment. We never receive or store your card details.

From them we receive, and keep, what is needed to support a purchase: your email address, the payment id, your licence key and its activation count. That is held in their dashboard under our account, and is used for delivering the key, answering support and honouring refunds. Nothing is sold, shared or used for marketing.

The feedback form

What you send through share feedback goes two places, both mine: a record in the same Google Firestore project described above, and an email to me so it actually gets read. The name, email and rating are optional, and leaving them blank sends the message anonymously. An address is used to reply and for nothing else, it is never added to a mailing list, and the feedback records cannot be read from any browser.

The email is delivered by Resend, an email provider, who handle it in transit. There is no third-party form service and no analytics on the form.

Email

If you email support, that email and its thread are kept so the conversation makes sense later. Nothing more is done with it.

Your rights

You can ask what is held about you, ask for it to be corrected, or ask for it to be deleted, by emailing support. Deletion of purchase records may be limited by the tax and accounting rules our payment provider operates under, and deleting a purchase record also removes the licence it proves, which will deactivate the app.

Data may be processed outside your country, since the hosting and payment services above operate globally.

Children

Kiiwi is not directed at children and collects nothing that would identify one.

Changes

Material changes will update the date at the top of this page. Because the app sends so little, most changes here will be about a service, not about new collection.