Privacy policy
Who we are
Keywitch is operated by Natalie Hubbard trading as Keywitch (ABN 70 983 741 786), based in Western Australia, Australia. We are bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth).
Questions about privacy: support@keywitch.com.au.
The short version
We hold your email address and the photos of keys you upload, plus what we derive from those photos. We use them to run the service and nothing else. We do not sell data, we do not advertise, we do not use your photos to train models, and we do not share your photos with anyone. You can export everything or delete everything, yourself, at any time.
What we collect
Information you give us
- Account details — your email address, and a first and last name if you choose to provide one. Your password is stored only as a cryptographic hash; we cannot read it.
- Key photographs — the images you upload.
- Labels you add — key names, notes, tag names and folder names. These are free text; whatever you type is what we store, so avoid putting addresses or other sensitive details in them if you'd rather we didn't hold them.
Information we derive
- Blade profiles and measurements — a numerical description of the cut pattern of each key, extracted from your photo. This is what matching compares. It is derived from your photo and is treated as identically sensitive.
- Processed images — cropped, annotated and plotted versions of your photo, generated during recognition.
Information collected automatically
- Server logs — IP address, browser user-agent, requested page, timestamp. Kept for security and debugging.
- Failed login attempts — recorded with the originating IP address so we can lock out password-guessing attacks.
- Error reports — if the site fails, technical details of the failure are recorded so we can fix it. These are configured to exclude request contents and account identifiers.
We do not use analytics, advertising, tracking pixels or third-party scripts of any kind. The only cookies we set are the ones that keep you signed in and protect forms against cross-site request forgery. There is no cookie banner because there is nothing to consent to.
Why we hold it, and on what basis
| What | Why |
|---|---|
| Email address | To identify your account, let you sign in, and send password resets and service notices |
| Key photos and blade profiles | To provide the service — there is no product without them |
| Names, notes, tags, folders | To let you organise and find your keys |
| Server logs, failed logins | Security, abuse prevention and diagnosing faults |
We do not send marketing email. If that ever changes, it will be opt-in and separately consented to.
Photographs of keys are sensitive
We treat key images with more care than ordinary uploads, because a clear photograph of a key can in principle be enough for someone to cut a working copy. In practice that means:
- Your images are private to your account. Every request for one is checked against your login and your ownership of that key — there are no public or guessable image links.
- Images are never shown to other users, published, syndicated or sold.
- Images are never used to train machine-learning models, ours or anyone else's.
- Staff do not browse user images. Access happens only where you have asked for support and it is necessary to answer you, or where the law requires it.
We do not know which lock, door or address any key belongs to unless you type it into a name or note yourself.
Where it is stored
Data is stored on a server located in Western Australia, Australia, and backups are held with Cloudflare R2. Backups are encrypted in transit. Some service providers we depend on may store or route data outside Australia; where that is the case it is listed below.
Who else is involved
We share data only with the providers we need to run the service:
| Provider | What they handle | Where |
|---|---|---|
| Binary Lane (Perth, Australia) | Hosting — the server your data lives on | Australia |
| Cloudflare R2 | Encrypted off-site backups | Asia-Pacific |
| Hostinger | Sending password-reset and service email (your email address only — never your photos) | European Union |
| Sentry | Error reports, configured to exclude personal data | United States |
We will disclose data to law enforcement or a regulator only where we are legally required to, and only what is required.
We do not sell personal information, and we do not disclose it for any purpose other than those described here.
How long we keep it
- While your account exists — your keys and photos are kept until you delete them or close your account.
- When you delete a key — the photo and every file derived from it are deleted from live storage immediately.
- When you close your account — your account, keys, photos, notes, tags and folders are deleted from live storage immediately.
- Backups — deleted data persists in encrypted backups for up to 30 days, after which those backups expire and are destroyed. We cannot selectively erase one person's data from an existing backup.
- Server logs — retained for 30 days.
Security
- All traffic is encrypted with HTTPS.
- Passwords are hashed; nobody, including us, can recover them.
- Repeated failed logins lock out the originating address.
- Every media file request is authenticated and ownership-checked.
- The server is kept patched, and administrative access is by SSH key only.
No system is perfectly secure. If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
Your rights
- Access — download everything we hold about you from your account page, at any time, without asking us.
- Correction — edit your key names, notes, tags and folders directly. Email us for anything you cannot change yourself.
- Deletion — delete individual keys, or close your account and remove everything, from the same page.
- Complaint — write to us first at support@keywitch.com.au. We will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Children
The service is not intended for children under 15, and we do not knowingly collect their information.
Changes
If we change this policy we will update the date at the top, and we will email account holders about any change that materially affects how your photos are handled.