Privacy Policy

The short version

Your shortcuts stay in your browser. Highkey only sends something to its server when you use the community features: browsing shared packs, voting on them, or publishing your own. We don't sell data, show ads, or track which websites you visit.

What stays on your device

The shortcuts you create, and the elements they're bound to, are saved in your browser's local extension storage. They aren't uploaded unless you publish them.

What the extension sends to our server

• A random Highkey ID. The extension makes up a random ID when you first use it. It isn't tied to your name, email or Google account. It's sent when you browse, upvote, report or install a pack, so each install counts one vote, report and download per pack and can show which packs you've already voted on.
• The website you're on, when you open the popup. The popup asks for community packs for the current site, which sends that site's domain (for example github.com) with your Highkey ID. The server uses it to answer the request and doesn't keep it.
• The list of sites that have packs. To show a badge when a site has community packs, the extension downloads the full list of sites that have packs and checks it in your browser. This doesn't tell the server which sites you visit.

When you publish a pack

Publishing requires signing in with Google. Highkey asks Google for your basic profile and email address only, and receives:

• Your Google account ID, name, email address and profile picture.
• The pack itself: the website, the shortcut names and key combinations, and how to find each element on the page. That can include the element's visible text and, for shortcuts limited to one page, that page's path.

Published packs are public. Anyone can see them on this website and in the extension, along with your name and profile picture as the author. Your email address is never shown publicly or included in any API response. We use it only to identify your account. Check a pack before you publish it, especially shortcuts made on pages that show personal information.

How we use it

Only to run the community features: listing and installing packs, counting votes, downloads and reports, and letting you update or remove what you published. We don't use it for advertising, sell it, or share it with anyone except the services below.

Where it's stored

The website and API run on Vercel, and community data is stored in MongoDB Atlas. Like most hosts, Vercel keeps short-lived request logs, which include IP addresses.

Removing your data

• Unpublish a pack from the Community tab of the Highkey dashboard. It's deleted right away.
• Uninstalling the extension deletes your shortcuts and Highkey ID from your browser.
• To delete your account details from our server, or for any other privacy question, open an issue on GitHub.

Changes

If this policy changes, we'll update this page and the date at the top.