Privacy Policy

Last updated: 6 October 2026 · Effective: 6 October 2026

1. Who we are

"Keyda", "we", "us" and "our" refer to the operator of the Keyda keyboard application for iOS, iPadOS and Android, the Keyda app for Mac, the Keyda browser extension, the keyda.in website, and accompanying services (the "Service"). If you have questions about this policy, contact us at support@keyda.in or via the Contact page.

For privacy, data-protection, account-deletion, and grievance requests, email support@keyda.in with the subject line Privacy Request — Keyda. We use that inbox as our privacy and grievance contact point.

2. What we collect

2.1 Account data and signed-in devices

Signing in. You can sign in with a phone number (a one-time code sent by SMS or WhatsApp), with Sign in with Apple, with Google, or with Facebook. We store the stable identifier the provider gives us for you and, where the provider shares it, your email address, your first and last name, a profile photo address, your language setting and, for phone sign-in, your phone number and its country code. Signing in with Apple on Android opens Apple's sign-in page in a browser tab; the app itself only ever receives a one-time code, and the result is the same account you would get on an iPhone. For Apple we also keep the "refresh token" Apple issues, encrypted, for one purpose: when you delete your account we use it to tell Apple to disconnect Keyda from your Apple ID. Where Google or Facebook issue a sign-in token we keep it encrypted too; the current version of Keyda does not use it for anything.

One-time codes. To send a phone sign-in code we pass your number and the code to our messaging provider (see section 4). We store only a hashed version of the code, for 30 days, together with the delivery result.

Device identifiers. Each installation has an identifier that is sent with sign-ins, AI requests and usage events: on iOS a random identifier created by the app, on Android the device's Android ID, and in the browser extension a random identifier created by the extension. Keyda does not use the iOS advertising identifier and never asks for tracking permission; on Android the measurement SDKs described in 2.7 request the advertising-ID permission.

Signed-in devices. Each time you sign in we create a session record for that installation, which is what Signed-in devices on your Profile screen (Settings → your profile) lists. A session record holds the device's model name (for example "iPhone 15" or "Pixel 8"), its platform, the app version, when it signed in and roughly when it was last active (updated at most once an hour). It does not hold an IP address or a location. From that list you can sign out any one device, or every device except the one in your hand. A device you sign out loses access to your account within about a minute; content it had already downloaded may remain on that device. Session records are removed 90 days after they are signed out or expire.

2.2 Your content — what is stored with your account and what stays on your device

Keyda stores the following with your account so it is available on every device you sign in to. All of it is scoped to your account and visible only to you unless you share it (see 2.12 and 2.18).

• Notes, documents, notebooks and sketches — the title and text of each, its type, and for notebooks and sketches the drawing itself (your strokes, in a format shared by all Keyda apps), as described in 2.18. They are uploaded automatically when you save, and anything already on your device when you sign in is uploaded once. Deleting one in the app deletes it from our servers.
• AI Assistant chats — every message you send and every reply, together with which AI produced it, whether it was Keyda's AI, your own key or an on-device model. Deleting a chat hides it from your history and removes its memory summary (2.5); the messages themselves are removed when you delete your account.
• Files you attach to a chat — images, PDFs, text and documents, and audio files you pick yourself. They are uploaded when you attach them (on Android, before you send the message). We extract text from documents, transcribe audio and describe images so the AI can use them (see 2.5 and section 4), and keep the file with the chat. Uploads that never become part of a message are removed after 24 hours.
• Profile files — documents you add on the User Information page specifically so the AI knows them (a CV, a portfolio). They are kept until you remove them, and are used only while "Share Information with AI" is on.
• Stickers — each sticker you create or import, with the text you made it from. The image file is stored at a web address that is not listed anywhere but can be opened by anyone who has it. Deleting a sticker in the current apps removes it from that device; the copy in your account is removed when you delete your account.
• Generated images — every picture Image Studio or the Assistant makes for you, including pictures drawn by a model on your own device, with the prompt you typed and the refined prompt if we rewrote it (see 2.14).
• Your profile — display name, profile photo, "About me" (bio), age, gender, writing style, and the User Information fields (occupation, organisation, location, education, relationship status, interests, hobbies, website and social links, preferred language). The profile photo is stored at a web address that is not listed anywhere but can be opened by anyone who has it, so that other members of a shared session can see it. If you wrote a bio on your device before this version, it is uploaded once when you next use the app. From these fields we compile a short profile that is given to the AI when "Share Information with AI" is on (2.5).
• Preferences — your keyboard feature toggles and preferred language are mirrored to our server on every launch, keyed by your device identifier (and your account once you sign in), so they can follow you and so we can see which features are used.

The following stay on your device and are not uploaded by the apps:

• Clipboard history and pinned clips. The keyboard reads your clipboard only to offer a paste or a reply on something you just copied, and keeps a history only if you turn clipboard capture on (off by default; iOS asks you once before the keyboard may read the clipboard at all). The history never leaves the device. The clipboard text itself is sent to the AI only when you tap an action on it — Smart Paste, Smart Reply, Translate, Summarise — and is then handled like any other AI request (2.5).
• Text shortcuts, learned words and adaptive suggestions.
• The keyboard's response history on iPhone and iPad (the last results the keyboard inserted).
• AI Memory (opt-in, "Remember conversation context", off by default). When on, the prompts and replies for each text field are saved in a database on your device so the AI stays coherent in a long conversation. Conversations with no activity for 30 days are pruned the next time the app opens, and "Forget everything" (Android: "Forget all memory") wipes the database. The database itself is never uploaded. However, when memory is on, a short summary of the recent turns is placed at the top of the next prompt, and that prompt travels to the AI model — and, for requests that go through Keyda's servers, is logged as described in 2.5. So "on your device" describes where the memory is kept, not where every word of it goes.
• Calendar events and reminders you create from the keyboard ("meeting tomorrow at 3pm") are added straight to your phone's own Calendar and Reminders apps, which hold them; the current apps do not upload them.

Signing out removes your sign-in from the device. On Android your library stays on the device so it is there when you sign back in; some Keyda content may also remain on an iPhone, iPad or Mac after sign-out. Uninstalling the app removes it.

2.3 Subscription & trial state

The trial is opt-in: you must tap "Start Free Trial" inside the app. We then record that your trial has started, with a 3-day window, a cap of 100 AI uses and 5 images, and we count the uses as you go. We also record whether and when you converted to a paid plan and how your subscription changed state (active, cancelled, expired). When you have no trial or plan we hold no subscription record for you — Keyda's own AI is simply locked. To enforce the one-trial-per-person rule even if you delete your account and sign up again, we keep a keyed hash of each identity (phone, email or provider id) that has used a trial; it cannot be turned back into the identity and is not linked to any account.

2.4 Bring-Your-Own-Key (BYOK)

Using your own AI provider API key requires no paid plan. The key itself:

• Is checked once by our server. When you add a key, the app sends it to our server, which makes one small test request to the provider with it and, if it works, stores the key encrypted (AES-256-GCM) against your account. The stored copy is not sent back to your devices and is not used by Keyda for any request of its own; it is deleted with your account. The key is also kept on each device where you entered it, and removing it in the app removes it from that device.

Where a BYOK request goes depends on the platform.

• iPhone, iPad and Mac: the app sends the request directly from your device to the provider you selected (OpenAI, Anthropic, Google, Groq or xAI). Keyda's servers are not in that path. Afterwards the app sends our server a usage record — provider, model, length-based token estimate, timing, success or failure — and, by default, the prompt and the reply, which are kept in your AI request log (2.5). You can stop the text being sent with Settings → Privacy → "Share AI Prompts & Replies"; the usage record without the text is still sent so your usage statistics work. Keyboard AI turns (Smart Assist, Smart Reply) are also saved as the short "recent context" described in 2.5, whatever that setting says.
• Android: the request is relayed through Keyda's server, which forwards it to the provider with your key. The prompt and reply are kept as described in 2.5. There is currently no Android setting to switch that off.

On every platform the AI Assistant saves the chat to your account (2.2) whichever engine answered. BYOK requests are billed to you by the provider, are governed by that provider's privacy policy, and never count against a Keyda quota.

2.5 AI requests through Keyda

Requests that use Keyda's own AI (a paid plan or trial) go to our server, which sends them to an AI provider from our pool. What the model sees is your message plus whatever context the feature adds: a note or the clipboard text you acted on, the page text from a link you pasted (below), your compiled profile when "Share Information with AI" is on, matching snippets from your own notes, documents, voice notes, attachments and past chats when "Remember conversation context" is on, the recent turns of the current chat, and work items from a connected workspace when you ask about one (2.13). Nothing about you is added to grammar fixes and rephrases — those receive only the text being changed.

• What we log. For each request we store the provider and model that answered, the kind of request, the prompt as your app sent it (including any memory, profile or page text the app placed in it, but not the extra context our server adds), the reply, how long it took and whether it succeeded, against your account. This powers your in-app usage statistics, lets us diagnose failures and detect abuse, and is kept for about 12 months (section 5). Our staff can read these logs when operating and supporting the Service. We do not sell them or hand them to anyone outside the processors in section 4, and Keyda does not train AI models on them.
• Provider fallback. You pick a preferred provider, but if it is unavailable or out of capacity your request may be answered by another provider in Keyda's pool. Section 4 lists every provider that can receive a request.
• Answer cache. To save repeated work, grammar-fix and rephrase requests (never chats, replies or anything that includes your profile or context) are kept for seven days in a cache that is shared across all users: the text you sent and the corrected result, with no account attached. If another user sends a near-identical text within that time, they may receive the cached result instead of a fresh one, and you may receive theirs. The comparison is done with an embedding model (section 4).
• Recent context. The last Assistant exchange and the last few keyboard AI turns are kept against your account so the next request can follow on; each new turn replaces the oldest, and they are deleted with your account.
• Memory of your content. So the Assistant can draw on what you have saved, the text of your notes, documents, voice notes (if synced) and attachments is split into passages and turned into embeddings by Google's Gemini embedding model (section 4); the passages and their embeddings are stored in our secondary database (Supabase). Personal chats that have been idle for a day are summarised in the background — the transcript is sent to Gemini for a short summary, which is stored the same way. Shared sessions are never summarised. The embeddings are only ever searched for your own account, are deleted when the source is deleted, and are wiped with your account. Your search queries in the app are embedded the same way to find matches.
• Reading links you ask about. When you include a web link in a prompt, our server fetches that publicly accessible page, extracts its text and includes it in your request. In the app a few links that the page directly references may also be fetched; the keyboard reads only the page you pasted. We fetch only the link you gave us, cache the page text for up to 30 days so repeat reads are fast, and never track your browsing. This is on by default and can be turned off in Settings (on Android, "Read web links").
• AI next-word suggestions ("Smart Suggestions", off by default) send the last part of the field you are typing in (a few hundred characters at most) to the AI after a pause. Everything else the keyboard does while you type — autocorrect, ordinary word suggestions, maths and dates — runs on the device.

2.6 Subscription and payment data

When you purchase a Lite or Pro plan through the app, the transaction is processed by the Apple App Store (iOS) or Google Play (Android). We record the store-issued purchase identifier (such as the Apple original transaction id or Google purchase token), the product/plan code, billing period (monthly or yearly), the amount and currency the store reports, and the purchase, renewal and expiry dates and status, which we validate against Apple's or Google's servers to keep your entitlement in sync. Your card, UPI, bank and other payment-instrument details are handled exclusively by Apple and Google — we never see or store them.

Web checkout (keyda.in/subscribe). If instead you buy a one-time period directly on our website, the transaction is processed by our payment partner Razorpay. To start that checkout, the app first asks our server for a short-lived, single-use code (valid about 60 seconds) that signs you into the web page without re-entering a password. Razorpay collects your card/UPI/bank details directly — we never see or store them. We pass Razorpay your account id, plan and billing period with the order, and pre-fill its payment sheet with the email address and phone number on your account so you do not have to retype them. We store the order id, payment id, amount, currency, plan code, billing period and status (created/paid/failed), use it to activate your Lite/Pro entitlement for the period you paid for, and email you a receipt.

2.7 Usage events, analytics and crash reports in the apps

Keyda's own usage events. To diagnose issues and see which features are used, the apps and the extension send us short events such as app opened, signed in, tab opened, note saved, theme changed and per-feature counts (for example how many characters Smart Reply inserted). They carry your device identifier, your account when you are signed in, and the platform. They do not contain the text you typed. Events are sent before you sign in as well, keyed by the device identifier only. When an AI call fails, the app also sends us the error the provider or our server returned (up to a couple of thousand characters) so we can fix it; the keyboard does the same for its own AI features.

Third-party measurement SDKs. The apps also include software from Google and Meta that collects data under those companies' own policies, as is common in mobile apps. Keyda shows no advertisements.

• Firebase (Google) — Firebase Cloud Messaging delivers push notifications (2.19) on both platforms. Firebase Analytics is included in both apps and collects standard app-usage and device information for Google's analytics service. On Android, Firebase Crashlytics also collects crash reports and the device details that come with them. See Google's privacy policy.
• Meta (Facebook) SDK — included for Facebook sign-in on both platforms. On iOS its app-event logging is on: it reports app launches and, after a verified purchase, a purchase event with the plan and amount, which Meta uses to measure the ad campaigns that bring people to Keyda; advertiser-identifier collection is switched off and the app never asks for tracking permission. On Android the SDK is initialised with its default settings. See Meta's privacy policy.
• Advertising ID permission (Android). Because the Google and Meta SDKs above are part of the app, the Android app declares the advertising-ID permission that they request. Keyda itself does not read or store the advertising ID.

These SDKs cannot be turned off inside Keyda. If you prefer not to have them run, the operating-system controls (for example resetting or deleting the advertising ID on Android) apply.

2.8 Voice & speech data

If you use voice typing or the voice assistant, Keyda uses your microphone only while you are actively recording — you start it by tapping the mic (or, on Android, from the "Talk to Keyda" tile, shortcut or widget), and it stops on its own after a short pause (Talk to Keyda on Android stops after 60 seconds at most). Keyda never listens in the background. On iOS, Apple does not allow any third-party keyboard to use the microphone, so recording happens in the Keyda app, which hands only the recognised text back to the keyboard. On Android recording happens in the keyboard itself, and Talk to Keyda runs as a short-lived microphone service with a visible notification.

• Who turns speech into text. On iPhone, iPad and Mac: Apple's Speech Recognition. Keyda asks for Apple's server-based recognition when it is available, because it is more accurate, and falls back to on-device recognition when it is not — so your audio is normally processed by Apple under Apple's privacy policy. On Android: the speech-recognition service installed on your device, usually Google's, under its provider's policy. To improve accuracy, Keyda gives the recogniser a list of words to expect; in the app this includes your display name and the titles of up to 40 of your notes and 40 of your documents.
• Raw audio. Keyda does not store your voice recordings and the current apps do not upload microphone audio to Keyda's servers. (Audio files you deliberately attach to an Assistant chat are different — see 2.2 and 2.5.)
• Transcripts. The recognised text is inserted where you were typing. On iOS it is also kept in a voice history on your device. Syncing that history to your Keyda account is off by default and happens only if you turn on "Sync voice history to cloud" in Settings; on iOS turning it on also uploads the history already on the device, and synced transcripts are indexed for the Assistant's memory (2.5). You can clear the history at any time. On Android, Talk to Keyda also copies what you said to the clipboard so you can paste it, and shows the live words in its notification, which is visible on the lock screen while you speak.
• Voice commands & AI. If what you said is an AI request, the transcribed text (never the audio) is sent like a typed AI request (2.4, 2.5). Spoken replies use your device's text-to-speech engine.

2.9 Website (keyda.in)

Our own visit log. Our website keeps a first-party visit log so we can see how many people reach the site and which pages and download buttons they use. For each visit we record the page path, referrer, any UTM campaign tags, your device/browser type, your IP address, and an approximate location (country, and where available region/city) that our server derives from the IP using an offline geo-IP database — no precise location and no permission prompt. This log uses no cookies, and the page script that feeds it honours your browser's Do Not Track setting. Each download of the Mac app from keyda.in is also counted by our server with the same details (path, device type, IP address and approximate location).

Third-party tags. Every page on keyda.in also loads the Google tag (Google Analytics 4 and Google Ads) and the Meta Pixel, which measure visits and whether an ad brought you here. They set cookies (such as _ga, _gcl_au and _fbp) and send your visit to Google and Meta under Google's and Meta's privacy policies. They do not honour Do Not Track. You can block them with your browser's tracking protection or an extension; the website works without them.

Contact form. If you write to us through the Contact page we store your name, email address, topic and message, together with your IP address and browser type, so we can reply and keep a record of the request.

2.10 Browser extension

The Keyda browser extension (Chrome) adds spelling/grammar correction to text fields on websites you visit, and gives you access to your Notes, Documents and AI Sessions in the browser. It handles data differently depending on the feature:

• Sign-in. You sign in with Google or phone OTP, the same as the app (see 2.1), and the extension sends its random device identifier with the sign-in.
• Spelling fixes — on your device. The extension checks words you type against a dictionary bundled with the extension itself. Misspelled words, and the word you click to fix, are not sent to our servers by the spell-check — the underline works signed out, and the one-tap fix needs sign-in but no AI and no plan. Tapping a fix records a usage event (2.7) with no text in it.
• Sentence-level suggestions — sent to our servers, on your action. The fuller correction runs when you click the floating Keyda button beside the field, press Alt+Shift+K (which applies the fix straight into the field), or use "Fix the field I'm typing in" in the popup. The text of the field you are editing — and nothing else: not the page address, title or surrounding page — is sent to Keyda's servers and handled as in 2.5. An optional Direct suggests setting, off by default, sends the field's text (up to about 600 characters) automatically when you focus a field that already has text or pause typing. Password, payment-card and one-time-code fields are skipped. You can turn the whole feature off in the extension's Settings, leaving only the on-device spelling fixes.
• Selected text — sent only when you act on it. Selecting text on a page shows a small toolbar (Response, Research, Fix, Rephrase, Tone, and under "More": Summarize, Translate, Explain / Simplify, Continue writing). Nothing is sent when you merely select. Choosing one of those actions sends only the text you selected to Keyda's servers, handled as in 2.5. The same is true of the right-click menu — "Fix grammar with Keyda," "Rephrase with Keyda," and "Save selection to Keyda Notes," which stores the selection as a note in your account.
• Your Notes, Documents and chats are fetched from your account when you open them, can be created, edited and deleted from the extension, and a copy of the lists (including note text and document bodies) is cached in the browser until you sign out. Chat messages sent from the extension are stored with your account like any Assistant chat. The chat does not read the page you are on.
• Preferences. Theme, feature toggles and the position of the floating button are stored in your browser and do not reach our servers. The per-site on/off switch is stored in your browser too, but while you are signed in the extension also sends the site's host name to our server when you switch a site off or back on, so the setting can follow your account.
• Sites you use Keyda on — optional, off by default. You may turn on Sync my site settings in the extension's Settings so your per-site switches follow you to your other signed-in browsers. Only while that is on, and only while you are signed in, we store the site's host name (for example mail.google.com), a count of how many times you used Keyda there, the kind of action you last used, when you first and last used it, whether you switched Keyda off there, and your extension's device identifier. We record this only when you actually use a Keyda feature on a site, never when you merely visit one, and never the page address, query string, title or contents. Nothing is recorded in Incognito windows. A best-effort filter skips common private-network names and obvious government, health, banking and adult domains, but it cannot recognise every such site. You can forget any single site, clear the whole list, or turn syncing off — turning it off deletes the stored list from our servers. Signing out does not delete the list; turn syncing off first if you want it gone.
• Usage events. The extension sends the usage events described in 2.7 (which surface was opened, which action was used), with its device identifier, also when you are not signed in. They never contain host names, page addresses or text.
• Permissions. So that it can work in any text field, the extension runs on every https page you open, including pages inside frames. That means it could see those pages; it does not use that access to record them. There is no navigation or page logging, and the extension does not hold the browser's history, tabs or web-navigation permissions. The only site information that ever leaves your browser is the host name described above. The extension writes to your clipboard when you copy a result and never reads it.

2.11 Desktop app (Mac)

Keyda for Mac is a desktop version of the app: your Notes, Documents, Sketches and AI chats, signed in to the same account and synced the same way as on mobile (see 2.1–2.6). Inside Keyda's own editors a writing check is on by default: after you pause typing, the paragraph you are working in is sent to Keyda's AI for correction, as in 2.5. It also offers one optional, desktop-only feature that needs a system permission:

• Keyda Suggests (System-wide Writing Check) — off by default, opt-in. When you turn this on, Keyda asks for macOS Accessibility permission. Only while it is enabled and permission is granted, a small companion helper reads the text of the single field you are currently focused on in whatever app you are typing in. It does nothing until you switch it on in Settings → Keyda Suggests, and you can revoke the Accessibility permission at any time in System Settings → Privacy & Security → Accessibility.
• Spelling underlines stay on your Mac. Misspelled-word underlines and their one-click fixes use Apple's built-in spell-checker and a bundled word list, on your device.
• AI suggestions go to Keyda. When you click the Keyda button that appears beside a field, the text of that field is sent to Keyda's AI for correction or rewriting; when you select text and choose an action (fix, rephrase, tone), the selected text is sent. These are handled as in 2.5. With the optional Direct suggests setting (off by default) the field's text is sent automatically about a second after you stop typing.
• Password fields are always skipped. The helper never reads secure/password fields, terminals or code editors, and it only looks at the field that currently has focus while the feature is enabled. It does not log your keystrokes or capture your screen. To insert a fix it may briefly use the clipboard, restoring what was there afterwards; clipboard contents are not sent anywhere.
• Updates. The Mac app checks keyda.in once a day for a new version; that request carries no account information.

2.12 Shared AI Sessions

You can invite up to 100 people into one shared AI chat (for planning, group study, teamwork). If you create or join a shared session:

• Who sees what. Every message sent in a shared session, and every AI reply to it, is visible to every other member of that session, along with a display name and profile photo identifying who sent it, and notices such as "Priya joined". Members can see the full running conversation, not just their own messages. Other members are also sent a push notification with the first part of a new message.
• Whose quota it runs on. AI replies in a shared session are produced on Keyda's servers with Keyda's own AI, and each one is charged to the plan or trial of the member who asked — not the creator's. A member on a free account can post messages but cannot trigger an AI reply.
• No personal context leaks in. AI replies inside a shared session never draw on any individual member's notes, documents, AI Memory, profile or past chats — only the shared conversation itself is used — and shared sessions are never summarised into anyone's memory.
• Retention. Shared session messages are stored on our servers. Any member can leave at any time, which hides the session from their history; the creator can end the session, which hides it for everyone. Ending or leaving does not erase the messages: each member's own messages are deleted when that member deletes their Keyda account, and the whole session when its creator deletes theirs.
• Invitations. Session links let anyone who has the link join once they sign in — treat a session link like an invitation you'd hand to a specific group, since Keyda cannot verify who ultimately opens it.

2.13 Connected workspaces (GitHub, Linear, Jira)

You can optionally connect a GitHub, Linear or Jira account so the Keyda assistant can answer questions about your work — "what's assigned to me?", "which pull requests are open?". Nothing is connected by default: each one requires you to authorise it explicitly in Settings → Integrations, and you can disconnect it in the same place at any time.

• What we store. For Linear and Jira: the access and refresh tokens the provider issues, encrypted (AES-256-GCM) and tied to your account, plus the workspace name and your account id there so we can show you what is connected. For GitHub: which GitHub App installation you authorised and the account it belongs to; access tokens for GitHub are short-lived (about an hour), minted when needed and cached encrypted. GitHub also notifies us when the installation is suspended or removed. We never receive or store your password for any of these services.
• What we read, and when. Only at the moment you ask a question that relates to that service. For Linear and Jira: issues assigned to you, recently updated issues, your team/project list, and issues matching a term in your question. For GitHub: your connected repositories, recent commits, open pull requests, and — only when you explicitly trigger a code review — the changed files of the pull request or commit you selected. We do not mirror or continuously sync your workspace, and we do not read anything on a schedule.
• Where it goes. What we fetch is placed into the instructions accompanying your AI request and sent to the AI provider handling that request (see 2.5 and section 4). That accompanying context is not stored in your AI request log; the answer is, and may quote issue keys, titles, statuses or authors.
• Code reviews are kept. When you ask for an AI code review, we store the result — the summary, each finding, and the parts of the code (the diff) the findings refer to — with your account, so the review can be shown again later. It is removed when you delete your account.
• Writes. Keyda only reads from Linear and Jira: it does not create, edit, comment on, transition or delete anything there. The permission screen those services show when you connect may list broader access than Keyda uses. On GitHub, Keyda writes only when you explicitly ask: posting the results of a code review you requested onto that pull request or as a check on that commit, and merging a pull request when you tap Merge.
• Other people's data. Issues and pull requests in a shared workspace may have been created by, mention, or be assigned to your colleagues. Keyda reads only what the account you connected can already see, and shows it only to you.
• Disconnecting. Disconnecting a Linear or Jira workspace in Settings → Integrations deletes the stored credential from our database immediately; disconnecting GitHub also removes the Keyda app from your GitHub account. You can additionally revoke Keyda from the provider's own account settings. Deleting your Keyda account removes these connections and stored reviews along with the rest of your account data.

2.14 Image generation (Image Studio)

Image Studio turns a written description into a picture. By default it runs on our servers, so the following leaves your device when you generate an image:

• Your prompt. The description you type. By default it is first rewritten into a fuller prompt by a text model from Keyda's pool so the picture matches what you meant; you can switch this off with Refine image prompts in Settings, in which case your wording is sent unchanged. Your profile and notes are never added to an image prompt.
• Reference images you attach. If you attach one of your own photos for the model to work from, that image is uploaded with the request. This happens only for an image you pick yourself, and only for that one request. We do not scan, index or upload your photo library.
• The image you get back. Images you create are stored on our servers against your account, with the prompt, so your gallery survives reinstalling the app, switching device, or signing out and back in. They are private to your account and are not shown to anyone else.
• Where it is processed. Your prompt and any reference image are sent to Replicate, the image-generation processor named in section 4. If no Replicate capacity is available and your request has no reference image, it may instead be drawn by an image model from another provider in Keyda's pool (OpenAI, Google or xAI). We do not use your prompts, your reference images or your generated images to train any AI model.
• On-device image generation. On a plan you can also download an image model to your device (2.16) and generate stickers and pictures with it. Those are drawn on your device, but the resulting images are stored with your account like any other.
• Deleting. Deleting an image or a whole session in the app deletes it from our servers as well, including the stored image file. Deleting your account removes all of them.
• Allowances. We keep a count of how many images you have generated in the current month so your plan's allowance can be applied (see our Terms). That is a number — it is not a copy of your images.

2.15 Location (app & keyboard)

Some things you can ask Keyda depend on where you are — "salons near me", or a bare "weather". Answering those needs a position, so:

• Only after you allow it. Your device location is read only if you grant the operating-system location permission (while using the app; Keyda never asks for background location). You can withdraw that permission at any time in iOS or Android settings, which stops this completely.
• When it is read and sent. On iOS the app takes a fix when you allow location and, once allowed, may refresh it when you open the app if the previous fix is more than 30 minutes old, so the keyboard has a recent position for "near me"; each fix is sent to our server. On Android the app takes a fix when you open the Nearby section of Settings, and the keyboard reads your last known position when you make a "near me" request. Coordinates are sent as part of that request.
• What we store. Your most recent position only — latitude, longitude, the accuracy figure the platform reports, and whether the fix came from GPS, the network, or was entered by you. It is a single record tied to your account, and each new fix overwrites the previous one. We keep no location history and cannot reconstruct where you have been. "Near me" results are also cached on our server by search term and position, without any account attached, so repeated searches nearby are faster; that cache is not currently cleared on a schedule.
• Who receives it. To answer a "near me" or weather question, the coordinates and your search term are sent to the mapping and weather services listed in section 4. They receive coordinates and a search term — not your name, email or account id. The "near me" text the keyboard inserts includes a map link centred on your position; you decide whether to send it.
• Deleting. The stored fix is deleted with your account. Revoking the OS permission stops any new fix being recorded.

2.16 On-device models

On a plan you can run language models (for text) and an image model (for stickers and pictures) on your own device instead of in the cloud. When you choose to install one, the app downloads the model files from the service that hosts them, Hugging Face (for the image model, the list of files to fetch comes from keyda.in first). Both see your device's IP address like any download; no account information is sent. Text generated by an on-device model is produced on your device and does not count against any quota. Two things still involve our servers: Assistant chats are saved to your account whichever model answered (2.2), and when "Remember conversation context" or link reading is on, the Assistant still asks our server for matching notes and for the page text before the on-device model answers (2.5). Images drawn on-device are stored with your account (2.14). On iPhone, iPad and Mac you can also choose Apple Intelligence's on-device model where your device supports it; that runs entirely under Apple's control on your device.

2.17 GIF search

The keyboard's GIF picker is powered by GIPHY. When you open it, your request (a search term, or "trending", with a page number and your keyboard language) goes to our server, which forwards it to GIPHY together with our API key and a content rating. GIPHY does not receive your account, your IP address or anything that identifies you. We do not store your GIF searches against your account; the results are kept in our server's memory for ten minutes so the same search is not repeated. The GIF images themselves — the previews in the grid and the GIF you pick — are loaded by your device directly from GIPHY's servers, so GIPHY sees your device's IP address when they load, under GIPHY's privacy policy. On iPhone the keyboard needs Full Access to reach the internet for this, as for every network feature.

2.18 Sharing, share-into-Keyda, exports, widgets and drawings

• Share links. When you share a note or document with a link, a snapshot of its title and text (not the drawing) is stored on our servers for 30 days, after which the link stops working; you can revoke it sooner. Anyone who has the link and is signed in to Keyda can view it and save a copy, and sees your display name and profile photo as the sender. Later edits to the original are not included.
• Sharing something into Keyda. You can share up to three files at a time, plus text or a link. On iPhone, iPad and Mac the share extension makes no network requests: what you share waits in storage shared with the app until you open Keyda. Something you chose to "Save to Notes" waits there until the app files it; something you chose to ask about waits up to 24 hours, other unfinished shares up to seven days, and the whole inbox is emptied when you sign out. On Android shared files are copied to the app's cache for 24 hours. "Save to Notes" turns it into a notebook, which syncs to your account like any other; "Ask Keyda" attaches the files to an Assistant draft, which uploads them at that point, before you send the message.
• Exporting. Exporting a note, document or sketch as a PDF or image creates an ordinary file on your device; where you send it is up to you. Exporting your account data is described in section 7.
• Widgets, Control Center and shortcuts. Keyda's home-screen widgets only open the app. The iOS Control Center button and the Android tile, shortcut and widget start voice capture as described in 2.8; nothing else is sent.
• Drawings. The strokes you draw in a notebook or sketch are stored with the document in a shared stroke format (tool, colour, width, points and optional pressure and timing), up to 4 MB per document, and are deleted with the document or your account. Drawings are included in your data export and are not sent to any AI model or embedding service.

2.19 Notifications and emails

• Push notifications. If you allow notifications, the app registers a push token for your device with Firebase Cloud Messaging (Google) and sends it to our server; we keep one token per account, together with which signed-in device registered it. We use it for shared-session activity (2.12) and service notices. The token is cleared when you sign out, when that device is removed from Signed-in devices, or when Google reports it no longer works. Notification text passes through Apple's and Google's push services.
• In-app notices. Service announcements may appear in the app's notification list; we record which ones you have read.
• Emails. If we have your email address we may send you a welcome email, receipts for web-checkout purchases, a confirmation when you delete your account, and occasional product emails, which carry an unsubscribe link. We keep a log of every email we send (address, subject, template, outcome), which also enforces our daily sending limit. Mail is sent through our hosting provider's mail service (section 4).

2.20 Server logs

Like every web service, our servers keep a request log: for each API request, the path, the response code, how long it took, the requesting IP address and the app or browser's user-agent string. Request bodies, sign-in tokens and your own API keys are never written to it, and search text, "near me" coordinates and device names are redacted from it. The log is a rolling file of fixed size (about 40 MB in total) that is overwritten as it fills, so entries are kept for a limited and variable period. It is used only for debugging and abuse investigation.

2.21 What we never collect

• Your ordinary typing. On the mobile keyboard, text leaves your device only for a feature you trigger (an AI action, voice, a lookup) or, if you turned it on, Smart Suggestions (2.5). Autocorrect, maths, dates and themes run on the device. On iOS, password fields are handled by the system's secure keyboard, which no third-party keyboard can read; on Android, Keyda does not record clipboard history in password fields. On Android, the text you type is also offered to your device's own spell-checker service, as with any keyboard.
• Passwords, one-time codes after verification, or your contacts. Keyda never asks for access to your contacts.
• Your photo library. We never scan, index or upload it. The only pictures that leave your device are ones you deliberately choose: a reference image in Image Studio, a photo or file you attach to a chat, a profile photo, a sticker you make from a photo or import, or a file you share into Keyda.
• Background microphone, screen or location. The microphone is used only while you record; location only while you are using the app or keyboard, and only with your permission; and Keyda never captures your screen.
• Raw voice recordings — only the recognised text, as described in 2.8.
• Your browsing history. Neither the browser extension nor the apps record the pages you visit. The extension stores a site's host name only through the per-site switch and the opt-in site list described in 2.10.
• Advertising profiles. Keyda shows no ads, does not sell your data, and does not ask for the iOS tracking permission. The measurement SDKs in 2.7 and the website tags in 2.9 are the only third-party analytics in the Service.

3. Why we collect it

Where privacy law requires a specific legal basis, our basis may include performance of a contract, consent, compliance with legal obligations, legitimate interests, or other permitted uses depending on the jurisdiction and feature involved. You may withdraw consent for optional features at any time by turning the feature off, clearing its data, or contacting us.

4. Who we share it with

We use the following processors and services to deliver the Service. None of them is sold or rented your data. Each receives only what is described here.

• AI providers in Keyda's pool — Groq, OpenAI, Anthropic, Google (Gemini) and xAI — receive the prompt and context described in 2.5 when you use Keyda's own AI. You choose a preferred provider; if it is unavailable, another provider in the pool may answer (2.5). With your own key (2.4), only the provider whose key you used receives the request. We do not send them our logs. Governed by each provider's privacy policy.
• Google (Gemini) — embeddings and summaries. Receives passages of your notes, documents, synced voice notes and attachment text to turn them into embeddings for the Assistant's memory and search, transcripts of your idle personal chats to produce short summaries, and the text of fix/rephrase requests for the shared answer cache (2.5).
• OpenAI and Google — attachments. Audio files you attach to a chat are transcribed by OpenAI's Whisper, and images you attach are described and read (OCR) by an OpenAI or Google vision model so the Assistant can use them (2.2).
• Replicate — runs the image-generation model behind Image Studio. When you generate an image it receives your prompt and any reference image you attached, under Replicate's privacy policy and its model providers' terms. It does not receive your name, email or account id. When Replicate is unavailable, an image model from OpenAI, Google or xAI may draw the picture instead (2.14).
• Supabase — our secondary database and file storage. Holds the embeddings and passages described in 2.5, the shared answer cache, the files you attach to chats and your profile files (private storage, reachable only through links our server mints), and the public-address files for stickers and profile photos (2.2). See Supabase's privacy policy.
• Twilio — sends phone sign-in codes by SMS and WhatsApp. Receives your phone number and the code. See Twilio's privacy policy.
• Apple — App Store purchases and their validation, Sign in with Apple, Speech Recognition (2.8) and Apple Push Notification service, governed by Apple's privacy policies. When you delete your account we tell Apple to disconnect Keyda from your Apple ID.
• Google — Google Play purchases and their validation, Google Sign-In, Firebase Cloud Messaging (push), Firebase Analytics in both apps and Firebase Crashlytics on Android (2.7), Google Analytics and Google Ads tags on the website (2.9), and your device's speech recogniser on most Android devices (2.8), all under Google's privacy policy.
• Meta — Facebook sign-in; the Meta SDK's app events in the apps, including a purchase event on iOS (2.7); and the Meta Pixel on the website (2.9), under Meta's privacy policy.
• Razorpay — if you buy through our web checkout at keyda.in/subscribe, Razorpay processes the payment and handles your payment details directly. It receives your Keyda account id, plan and billing period with the order, and the email address and phone number on your account to pre-fill its form, under Razorpay's privacy policy.
• GIPHY — GIF search (2.17). Receives your search term, paging, rating and language from our server without your identity, and your device's IP address when GIF files load.
• Hugging Face — hosts the on-device model files the app downloads when you install a model (2.16). Receives your device's IP address for the download.
• GitHub, Linear and Atlassian (Jira) — only if you connect one of those accounts (see 2.13). We call their APIs on your behalf to read the work items needed to answer your question, and on GitHub to post reviews and merge when you ask, under GitHub's, Linear's and Atlassian's own privacy policies.
• Open-Meteo — weather and place-name lookup. Receives coordinates or a place name when you ask about the weather.
• OpenStreetMap (Overpass API) — nearby places. Receives coordinates and the category you searched for when you ask something like "salons near me".
• Wikipedia, dictionaryapi.dev, Frankfurter and Nager.Date — the reference lookups behind definitions, currency conversion and public-holiday answers. Each receives only the term, currency pair or country in your question. None receives anything identifying you.
• Hosting, database and email — our servers, primary database and outgoing email run on commercial hosting infrastructure (Hostinger) under standard data-processing terms.

We do not sell your personal data and Keyda shows no advertising. The Google and Meta software described in 2.7 and 2.9 is used to measure usage and the campaigns that bring people to Keyda; it is the only third-party analytics in the Service.

5. How long we keep it

These are the windows our systems enforce. Anything not listed is kept for the lifetime of your account and deleted when you delete it (section 7).

• Account data, your content, profile, chats, images, stickers, drawings, connected workspaces and stored code reviews: until you delete them or your account.
• Subscription and payment records: for the lifetime of your account; they are deleted with it. Apple, Google and Razorpay keep their own records of your purchases under their policies and for as long as the law requires them to.
• Trial state: deleted with your account, except the keyed identity hash that enforces one trial per person (2.3), which is kept indefinitely and is not linked to any account.
• AI request logs: 12 months, then deleted. The per-day usage counters behind your statistics (numbers only) are kept with your account. If you delete your account before then, the log rows lose your account id and are deleted at the end of their 12 months.
• Shared answer cache (2.5): 7 days.
• Memory summaries and embeddings (2.5): until the note, document, attachment or chat they came from is deleted, or your account is.
• Fetched web pages (2.5): 30 days.
• Chat attachments: uploads that never became part of a message, 24 hours; otherwise until you delete the file or your account. Profile files: until you remove them or delete your account.
• Shared AI sessions: leaving or ending a session hides it; each member's messages are deleted when that member deletes their account, and the whole session when its creator deletes theirs (2.12).
• Share links (2.18): the snapshot stops being accessible 30 days after sharing, or when you revoke it, and is deleted with your account.
• Website visit logs (incl. IP & approximate location) and download clicks: 12 months, then deleted.
• Usage events (2.7): 90 days.
• Signed-in devices: removed 90 days after the device is signed out or its 30-day sign-in expires.
• Browser-extension site list (only if you opted in): 90 days from the last time you used Keyda on that site, then deleted automatically. You can delete it sooner — forget one site, clear the list, or turn "Sync my site settings" off.
• Phone sign-in codes: hashed, 30 days.
• Email log and contact-form messages: kept as business records; not deleted with your account.
• Server request log (2.20): rolling, overwritten as the file fills.
• AI Memory (device-only): conversations idle for 30 days are pruned when the app opens; "Forget everything" wipes it; on iOS signing out wipes it too.
• Voice transcripts: kept in a capped on-device history on iOS; clearing the voice history in Settings wipes it. If you opt in to cloud sync, the synced copy is removed when you clear it or delete your account. Raw audio is never retained.
• Location: a single most-recent fix per account, overwritten by each new one and deleted with your account.

6. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, restrict or object to certain processing, withdraw consent, appeal or complain, and appoint someone to exercise rights on your behalf where the law allows. To exercise any of these rights, use the in-app controls in section 7 or email support@keyda.in. We respond within 30 days unless a shorter period is required by law.

Indian users may have rights under the Digital Personal Data Protection Act, 2023 (DPDP Act). EU/UK users may have rights under the GDPR/UK GDPR. California users may have rights under the CCPA/CPRA. We will not discriminate against you for exercising privacy rights.

7. Account deletion and data export

Export. Both apps can give you a copy of your account data as a file: on iPhone, iPad and Mac, open Settings, tap your profile at the top, and use Export my data under "Your Data"; on Android use Download my data in Settings → Privacy or on your Profile screen. The export includes your account record, notes, documents and drawings, chats and messages, profile details and your compiled profile, preferences, voice history, generated-image and sticker metadata (not the image files themselves), attachment metadata and extracted text, your last location, connected-workspace names, events, subscription records, Apple and Razorpay payment records, which providers you added keys for (never the keys), AI request logs (the most recent 5,000) and your signed-in devices. It does not include push tokens, sign-in tokens or password hashes.

Deletion. You can delete your account in the same place: Delete account on your Profile screen in the iOS and Mac app, or on Android Delete my account in Settings → Privacy (also Delete account on your Profile screen). You can also email support@keyda.in. Deleting your account removes your account record, signed-in devices, notes, documents and drawings, chats and messages (your own messages in any chat, and every chat you own), attachments and profile files including their stored files, stickers and generated images including their files, your profile and compiled profile, preferences, usage counters, voice history, location, your own API keys, connected workspaces and stored code reviews, subscription and payment records, push token, notifications, the extension site list, usage events, and the embeddings and memory summaries in our secondary database. We also tell Apple to disconnect Keyda from your Apple ID if you signed in that way, and send a confirmation to your email address if we have one.

What remains after deletion: AI request log entries with your account id removed, until their 12-month expiry; the log of emails we sent you; any message you sent us through the Contact form; the keyed identity hash that prevents a second free trial; and whatever Apple, Google and Razorpay hold about your purchases under their own policies. Deleting your account does not cancel an App Store or Google Play subscription — cancel renewal in the store's subscription settings.

Device-only data such as clipboard history, AI Memory, text shortcuts and local voice history can be cleared from the app or removed by uninstalling it. The browser extension's site list can be deleted at any time from its Settings → Sites — forget a single site, clear the whole list, or turn "Sync my site settings" off.

8. Children and minors

Keyda is not directed to children. You must be at least 13 to use the Service, and if you are under 18 you may use it only with consent from a parent or legal guardian where required. We do not knowingly collect personal data from children under 13. We also do not knowingly process children's personal data for targeted advertising, behavioural monitoring, tracking, or in a way that is detrimental to a child. If you believe a minor has provided us with personal data without the required consent, contact us and we will take appropriate steps to delete it.

9. Security

We use HTTPS for every connection; AES-256-GCM at-rest encryption for your own API keys, for connected-workspace credentials and for sign-in tokens issued by Apple, Google or Facebook; per-user data scoping so two accounts on the same device cannot read each other's content; and server-side checks so that AI requests, content and usage are always attributed to the signed-in account rather than to whatever a client claims.

Sign-in tokens. Signing in gives your device a token that is valid for up to 30 days and tied to that signed-in device. You can end any device's access from Signed-in devices on your Profile screen (2.1); the signed-out device is refused within about a minute. On Android the token and your own API keys are kept in Android's encrypted preferences. On iPhone, iPad and Mac the token is kept in the Keychain and also in storage shared between the Keyda app and its keyboard, share extension and Mac helper so that they can act on your behalf; your own API keys are kept in that shared storage too. On Android, if you use Google's device backup, the backup includes Keyda's local library (notes, drawings, stickers and images) but not your sign-in token, your own API keys, AI Memory, clipboard history and pinned clips, text shortcuts or the Hindi words the keyboard has learned.

We monitor for vulnerabilities and apply security updates. No system is perfectly secure — please report any issue you discover to support@keyda.in.

10. International transfers

Our servers, infrastructure providers, app-store providers and AI providers may process data in countries other than the one where you live. Where required, we rely on applicable transfer safeguards, store-provider terms, processor commitments, and any jurisdictional restrictions that apply to the Service.

11. Changes to this policy

We may update this policy. Material changes will be announced in-app and on this page. The "Last updated" date at the top of this page reflects the current version.

12. Contact

Questions or requests? Email support@keyda.in or use the Contact form.