Privacy Policy

1. Scope

This Privacy Policy describes how kiddyproof (“kiddyproof”, “we”, “us” or “our”) collects, uses and discloses information in connection with the kiddyproof macOS application (the “Application”) and the website at kiddyproof.app (the “Site”, and together with the Application, the “Services”).

By using the Services, you agree to the practices described in this Policy. If you do not agree, do not use the Services.

2. Information We Collect

2.1 Information you provide

We collect information you submit directly: the contents of any correspondence you send to us by email; the information associated with a purchase as described in Section 2.4; and, if you use the “send me the link” form on the Site, the email address you enter. That address is used solely to send you one message containing the download link. It is not stored, not added to any list, and not used for any other purpose; a salted hash of it is retained for 24 hours only to prevent repeated sends to the same address.

2.2 Information stored locally by the Application

The Application does not require an account and contains no analytics or telemetry components. The following information is stored locally on your device and is not transmitted to us:

This information is removed when the Application and its Application Support folder are deleted.

2.3 Keyboard and pointer input

The Application requires macOS Accessibility permission in order to suppress keyboard and pointer input while its restricted mode is active. Input events are processed transiently in memory for two purposes: rendering a corresponding on-screen character, and detecting the key combination that exits the restricted mode. Input is not recorded, logged, stored or transmitted, and the Application contains no facility to do so.

2.4 Purchase information

Purchases are processed by Creem, operated by Armitage Labs OÜ, which acts as merchant of record. Payment card details are submitted directly to Creem and its payment processors and are never received or stored by us. We receive order records consisting of the purchaser's email address, the license key issued, and transaction details such as amount, date and the country used for tax determination.

2.5 Activation

Following purchase, an activation page operated by us issues a key readable by the Application. Creem returns you to that page with a checkout identifier; the page sends that identifier to the Creem API to confirm the purchase and receives the associated order details, including the purchaser's email address, in response. That email address is written into the issued key so the license is tied to the purchaser. The activation service does not maintain a database and does not retain email addresses; its operational logs record a checkout identifier only. Once issued, the resulting key is verified by the Application locally and without network access.

2.6 Information collected automatically

When you visit the Site, our analytics software records aggregate information including pages viewed, approximate country of origin, referring website, browser type and device type. Requests for the download link and for the Application’s update manifest are additionally recorded at our edge network as aggregate datapoints (operating system, approximate country, network operator, and a salted, non-reversible hash of the requesting address) so that we can count downloads and active installations. No raw IP address is stored. Advertising technology on our marketing pages records page views and certain actions as described in Section 5.

The Application periodically requests an update manifest from our server. This request discloses your IP address and a user-agent string identifying the Application version and operating system version. It does not include your license key or any usage information. Automatic update checks can be disabled in the Application.

3. How We Use Information

We use information for the following purposes:

• to deliver license keys and provide the Services;
• to respond to support requests and correspondence;
• to distribute software updates;
• to measure website traffic and the effectiveness of advertising;
• to detect and prevent fraud and misuse; and
• to comply with legal, tax and accounting obligations.

We do not sell personal information, and we do not use personal information for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal Bases for Processing

Where the EU or UK General Data Protection Regulation applies, we process personal information on the following legal bases: performance of a contract, for delivering and supporting a license purchased by you; legitimate interests, for measuring website traffic, advertising effectiveness, and preventing fraud; and compliance with legal obligations, for tax and accounting records.

5. Cookies and Tracking

Our analytics software is cookieless and does not track users across other websites.

Our marketing pages load the Meta Pixel, supplied by Meta Platforms, Inc., which sets cookies and transmits page views and certain actions, such as initiating a download or beginning checkout, to Meta. Meta may associate this information with an existing Meta account and use it for advertising measurement and targeting in accordance with its own privacy policy. This Privacy Policy page and the Terms of Service page do not load the Meta Pixel.

You may limit this processing by using a browser or extension that blocks tracking technologies, by adjusting the Off-Facebook Activity settings in your Meta account, or through the industry opt-out tools available at optout.aboutads.info. The Services remain fully functional if these technologies are blocked.

6. Service Providers

We use the following third parties, each of which processes information under its own privacy policy:

Our analytics software is self-hosted and is not operated by a third party.

7. Data Retention

Order records are retained by Creem for the period required by applicable tax and accounting law. Correspondence is retained for as long as necessary to provide support and is then deleted. Analytics data is aggregate and is retained on a rolling basis. Information stored locally by the Application is retained on your device until you delete it.

8. International Transfers

We are established in the United States, and our service providers process information in the United States and other jurisdictions. Where information is transferred from the European Economic Area, the United Kingdom or Switzerland, such transfers are made on the basis of the Standard Contractual Clauses or another lawful transfer mechanism operated by the relevant provider.

9. Children's Privacy

The Services are offered to and purchased by adults. The Application is not directed to children as an online service: it contains no account registration, user profiles, messaging, social features or advertising.

We do not knowingly collect personal information from children, including children under 13 years of age. The Application provides no means by which such information could be collected, as it transmits no usage information. If you believe a child has provided personal information to us, contact us at the address in Section 13 and we will delete it.

10. Your Rights

Subject to applicable law, including the EU and UK General Data Protection Regulation, the California Consumer Privacy Act and the Texas Data Privacy and Security Act, you may have the right to request access to the personal information we hold about you, to request its correction or deletion, to obtain a copy in a portable format, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.

To exercise these rights, contact us at the address in Section 13. We will respond within the period required by applicable law and in any event within 30 days. We may ask you to confirm the email address associated with your purchase in order to verify your request. You will not be charged for exercising these rights, and we will not discriminate against you for doing so.

We do not sell personal information. The sharing of advertising measurement data described in Section 5 may constitute “sharing for cross-context behavioral advertising” under California law; the opt-out methods described in that section apply.

If you are located in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with your national supervisory authority.

11. Security

The Application is signed with an Apple Developer ID and notarized by Apple. Updates are verified against a cryptographic signature before installation. The Site is served over HTTPS. While we implement measures appropriate to the limited information we process, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The date of the most recent revision appears at the top of this page. Material changes will be indicated on this page. Continued use of the Services after a revision constitutes acceptance of the revised Policy.

13. Contact

Questions or requests relating to this Privacy Policy may be sent to [email protected].