// last updated: April 16, 2026
Privacy Policy
Keystroke is built on a single conviction: your words stay yours. This policy is the long-form version of that promise — what we collect, what we don't, and where the edges are.
The short version
The Keystroke desktop app collects nothing. No telemetry. No analytics. No crash reports. No update pings. Everything you type, everything the app learns about your writing, and your license key all live exclusively on your machine. The only data that ever leaves your computer is the prompts you knowingly send to the AI provider you chose, after sixteen PII detectors scrub them.
This website (the page you're reading) collects nothing either — no cookies, no analytics, no fingerprinting. If you buy a Pro license, our payment processor (Lemon Squeezy) handles the transaction and we receive your email address so we can deliver your license key.
Who this policy applies to
"Keystroke" refers to the desktop application for Windows, this website, and the services operated by Peter Nicholas Kessler ("we", "us"). It applies to anyone who downloads the app, visits this site, or purchases a Pro license.
What the desktop app collects
Nothing. Specifically:
- No telemetry, usage analytics, or feature flags
- No crash or error reporting
- No update checker or version pings
- No account system, no login, no user identifier
- No window titles, file paths, or screen contents are transmitted
Everything the app stores — your settings, your learning database (Pro), your analytics dashboard data, your logs, your encrypted API keys — lives in %AppData%/Keystroke on your local machine. We have no copy. We have no way to access it. If you uninstall the app and delete that folder, every trace is gone.
What leaves your machine, and when
Keystroke generates suggestions by sending prompts to an AI provider you configured. The providers Keystroke supports are:
- Google Gemini — when you use the Gemini engine
- Anthropic Claude — when you use the Claude engine
- OpenAI GPT — when you use the GPT engine
- OpenRouter — when you use the OpenRouter engine (which then routes to whichever model you selected)
- Ollama — runs locally on your machine; no network calls leave your computer
When you use a cloud engine, the prompt — which contains a rolling window of recent text you typed, plus context about the application you're typing in — is sent directly from your machine to that provider's API using your API key. The data does not pass through any Keystroke-operated server. We never see it.
Before any prompt is transmitted, sixteen PII detectors run locally and either redact or block the request. Categories include: credit cards, SSNs, emails, phone numbers, IPv4/IPv6 addresses, JWTs, bearer tokens, API keys, AWS secrets, private keys, OAuth tokens, IBANs, passwords, street addresses, and any custom regex you define. You can inspect the exact prompt shape that would be sent, in real time, from the Settings window.
Your relationship with AI providers
Each AI provider has its own privacy policy and data-handling practices. When you configure Keystroke with a provider's API key, you are entering a direct relationship with that provider, governed by their terms. We strongly recommend reviewing them:
Most providers offer enterprise or paid tiers where prompts are not used for model training. If that matters to you, configure that with the provider directly.
Your API keys
API keys you enter into Keystroke are encrypted at rest using the Windows Data Protection API (DPAPI), scoped to your user account. They are never stored in plaintext, never transmitted to us, and never leave your machine except as part of the standard authorization headers on requests to the provider you configured.
Your license key
Pro license keys are validated entirely offline using ECDSA P-256 signature verification. The app never contacts any license server. There is no activation check. There is no usage report. The key sits in your local config and is verified mathematically on your machine.
We retain a record of which email address purchased which license key so we can reissue keys if you lose them. That record is stored with our payment processor (Lemon Squeezy) and in our email (see below).
This website
This site is a static set of HTML, CSS, and JavaScript files served from a CDN. It sets no cookies, runs no analytics, and contains no third-party tracking scripts. Web fonts are loaded from Google Fonts, which may log your IP address as part of ordinary HTTP traffic — this is the only third-party network connection the page makes.
Payments and license delivery
Pro purchases are processed by Lemon Squeezy, acting as our merchant of record. When you check out, Lemon Squeezy collects:
- Your email address
- Your billing details (name, country, postal code where required for tax)
- Your payment method (card or other method, handled by their PCI-compliant processors)
We receive your email address and order metadata so we can deliver your license key and provide support. We do not receive your card number or full billing address. Lemon Squeezy's privacy practices are governed by their privacy policy.
Email and support
If you email support@keystroke-app.com, your message and email address are stored in our inbox so we can reply. We don't add you to any list, send marketing email, or share your address with anyone.
Children
Keystroke is not directed at children under 13 (or 16 in jurisdictions where that threshold applies). We do not knowingly collect data from children.
Your rights (GDPR, CCPA, and similar)
Because the app collects no personal data, most data-subject rights are satisfied by design — there is nothing to access, delete, or correct. For data held by our payment processor (your purchase email and order history), you have the right to request access, correction, deletion, or export. Contact us at the address below and we will assist within 30 days.
Data retention
Data on your machine: kept until you delete it. Purchase records held by Lemon Squeezy: retained as required by tax and accounting law (typically 7 years). Email correspondence: retained until you ask us to delete it, or until it is no longer relevant to providing support.
International transfers
The desktop app makes no transfers — its data stays on your machine. Cloud AI requests go directly from your machine to the provider you selected; the provider's jurisdiction is governed by their terms. Lemon Squeezy operates internationally and may process payment data across borders under standard contractual clauses.
Changes to this policy
If we materially change this policy, the "last updated" date at the top will reflect the change. Significant changes affecting active customers will also be communicated by email to the address on file with Lemon Squeezy.
Contact
Questions, requests, or concerns: support@keystroke-app.com.