This Privacy Policy describes how Keyaway ("Keyaway", "we", "us") handles personal information when you use the Keyaway iOS app and related services. Keyaway is operated by Satish Nagabhyrava as an independent developer.
Account, listing, and swap-request data are stored in Supabase, our infrastructure provider. Apple App Store handles purchase data when applicable. Email delivery for password resets goes through Supabase's transactional mail provider.
Keyaway is operated from the United States, and Supabase processes data in U.S.-based infrastructure (AWS US-East). If you are located in the European Economic Area, the United Kingdom, or Switzerland, your personal data is transferred to the U.S. for processing. Where the EU-U.S. Data Privacy Framework (DPF) applies, that mechanism governs the transfer; where DPF coverage is unavailable, transfers rely on the European Commission's Standard Contractual Clauses (Module 2 — controller to processor) executed with Supabase.
Schrems II considerations: we restrict access to U.S. infrastructure to those with a legitimate operational need, encrypt data at rest and in transit, and have documented our transfer impact assessment. EEA, UK, and Swiss residents may exercise rights under the GDPR (Articles 15–22) by emailing [email protected]: right of access, rectification, erasure, restriction, data portability, objection, and to lodge a complaint with your local supervisory authority.
For as long as your account exists. When you delete your account from inside the app (Profile → Delete account), we delete your auth row, listings, and outgoing swap requests immediately. Records of your acceptance of legal disclaimers are retained for the duration of your account for dispute purposes and are deleted on account deletion. Backups are purged within 30 days.
If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the CPRA:
To exercise any CCPA right, email [email protected]. We will verify your identity using the email address associated with your Keyaway account and respond within 45 days. Keyaway does not sell or share personal information as those terms are defined in the CCPA, and we do not use personal information for cross-context behavioral advertising.
Keyaway is not directed to children under 13, and we do not knowingly collect personal information from children under 13 in violation of the U.S. Children's Online Privacy Protection Act (COPPA). If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided personal information to Keyaway, please contact [email protected].
Separately, Keyaway is rated 17+ on the App Store, and we require a self-affirmation that you are 17 or older to use the app. Hosting (publishing a listing) requires a separate self-affirmation that you are 18 or older, since most U.S. states require legal adulthood to enter binding home-occupancy arrangements.
If we update this policy, we will revise the date at the top and post the new policy at this URL.