What we do and don't do

1. What we collect

We collect the absolute minimum needed to operate the Service. Here's the complete list:

That's it. We don't collect your name, location (beyond country-level for abuse prevention), phone number, social media handles, or any other personal information.

2. What we don't collect

Sometimes it's easier to list what we don't have. We do not collect:

• Your name or identity — we have no way to know who you are
• Your precise location — only country-level IP geolocation for abuse prevention (rate limiting by region)
• Your browsing history — we don't track what pages you visit or how long you stay
• Your tool inputs — prompts you type into tools are sent to the AI engine for processing, then discarded; we never store them
• Your tool outputs — the content the AI generates is returned to your browser and stored locally; we don't keep a copy
• Your BYOK API keys — these are stored only in your browser's local storage; they never touch our servers
• Your screenshots — images you attach to the AI Helper agent are analyzed in the moment, then immediately deleted from our servers
• Your voice recordings — speech-to-text transcription happens in your browser; audio is never recorded, sent, or stored
• Your payment card details — these go directly to our payment processor; we never see, touch, or store them
• Cookie-based tracking IDs — we don't drop advertising or analytics cookies that follow you across other websites

3. How we use the data we collect

We use the limited data we collect for exactly five purposes:

1. Operate the Service: Enforce free-tier rate limits, route AI requests, deliver generated output to your browser
2. Process payments: Verify premium licenses, apply the 1-PC device lock, send credit-expiry reminders
3. Fix bugs: Diagnose errors from anonymized logs so we can ship fixes (usually within 24 hours)
4. Understand usage: See which tools are popular so we know where to focus development effort
5. Improve the AI Helper agent: Analyze conversation patterns to provide better responses and auto-discover new tools

We do not use your data for:

• Advertising or ad targeting
• Email marketing (we don't send newsletters; we only email you about your license or your support request)
• Selling to third parties
• Training AI models
• Building profiles of individual users
• Sharing with law enforcement unless legally compelled (we've never received such a request)

4. We don't train AI on your inputs

Here's what actually happens to your inputs:

1. You submit a prompt (e.g., "Generate 5 hooks for a fitness YouTube video")
2. The prompt is sent to our AI infrastructure for processing
3. The AI generates output and returns it to your browser
4. The prompt and output are discarded — we do not store them on our servers

The AI engines we use may have their own data retention policies (typically 30 days for abuse monitoring, then deletion). We cannot control their policies, but we can promise that we never store, log, or reuse your inputs.

If you bring your own API key (BYOK — available in all tools and the AI Helper agent), your inputs go directly to the AI provider you choose — they never pass through our servers at all.

5. AI Helper agent privacy

The AI Helper agent (the 💬 chat bubble at the bottom right of every page) provides instant help finding tools, walking through setup, and answering questions. Here's how it handles your privacy:

• Chat messages: Your text messages are sent to our AI for processing, then the response is returned to you. Conversations are logged for 365 days (to improve the service), then automatically deleted.
• Screenshots: Images you attach (via 📎 button, drag-and-drop, or paste) are sent securely to our AI for analysis, then immediately deleted from our servers. We never store your screenshots — they're analyzed in the moment and discarded.
• Voice input: When you click the 🎤 mic button, speech-to-text transcription happens in your browser using the Web Speech API. Your audio is never recorded, sent to our servers, or stored — only the transcribed text is sent as your chat message.
• Voice output: When you enable 🔊 voice output, the AI's text response is read aloud by your browser's built-in text-to-speech engine. No audio is sent to or stored on our servers.
• BYOK keys: If you've added your own API keys, the AI Helper tries them first. Your keys are sent over HTTPS with your chat request, used in-memory only, and never stored on our servers.
• Feature suggestions: Messages marked as suggestions (via the 💡 button or auto-detected) are saved to our suggestions database for our team to review. If you provided your email, we may contact you when the feature is built.
• Legal flags: If your message contains legal threat keywords (in any of 10 languages), the conversation is flagged and retained permanently for legal protection. You'll see a calm, professional response with links to our policies.

6. BYOK (Bring Your Own Key) privacy

BYOK lets you add your own AI provider API key (Groq, OpenAI, Claude, Gemini, GLM, or Mistral) to any tool — or to the AI Helper agent — for unlimited usage. Here's how your keys are handled:

• Storage: Your API keys are stored only in your browser's local storage (same key shared across all ClickKitFree tools + AI Helper). They never touch our servers for storage.
• Transmission: When you send a chat message or generate content, your keys are included in the request over HTTPS (encrypted in transit), used in-memory for that specific request, then discarded.
• Logging: Your keys are never logged, never written to error logs, never stored in any database.
• Sharing: Your keys are never shared with third parties, never sent to any service other than the AI provider they belong to.
• Deletion: You can clear your keys anytime by clicking the 🔑 button in the AI Helper → "🗑️ Clear All Keys". This removes them from your browser immediately.
• Fallback: If your BYOK key fails (invalid, expired, or rate-limited), the system automatically falls back to our platform keys. You'll see a toast notification so you know your key needs updating.

7. Cookies & local storage

We use the absolute minimum cookies and local storage required to operate the Service:

We do not use:

• Google Analytics cookies
• Facebook Pixel
• LinkedIn Insight Tag
• Twitter/X tracking pixels
• Ad retargeting cookies (Google Ads, Meta Ads, etc.)
• Third-party session-continuation cookies

8. Payment data

When you purchase a premium license, payment is processed by a secure third-party payment processor. We never see, store, or transmit your card details.

Here's what each party sees:

• The payment processor: Your card number, billing address, transaction amount. They're PCI DSS Level 1 compliant (the highest security standard).
• ClickKitFree: Your email address, the license key issued, the product purchased, and the transaction timestamp. That's it.
• You: A receipt email from the processor and a license key to enter in the tool.

If you request a refund (see our Refund Policy), the processor returns the money to your original payment method. We don't handle the money itself.

9. Third-party services

We use a small number of third-party services to operate the site. Each one has access to the minimum data needed to do its job:

• AI infrastructure providers: Receive your prompts to process your request. They have their own privacy policies — we recommend reviewing them. We do not share your identity with them.
• Payment processor: Handles all payment card data. We never see your card details.
• Hosting provider: Hosts the website and serves pages. May log IP addresses for security/abuse prevention (standard practice).
• Email provider: Sends license-key delivery emails and support replies. Sees your email address and the content of our emails.
• BYOK providers (if you use BYOK): When you add your own API key, your prompts go directly to your chosen provider (Groq, OpenAI, Claude, Gemini, GLM, or Mistral). Their privacy policy applies — not ours. We do not see or store your keys.

We do not use:

• Google Analytics (we use self-hosted, privacy-respecting analytics)
• Facebook / Meta Pixel
• Advertising networks
• Data brokers
• Session recording tools (Hotjar, FullStory, etc.)

10. Your rights

Even though we collect very little data, you have full control over what we do have. Your rights include:

• Right to access: Email us to request a copy of any data we hold about you
• Right to deletion: Email us to request deletion of your data — we'll wipe it within 30 days. You can also submit a deletion request at /data-deletion/.
• Right to correction: If we have incorrect information about you, email us to correct it
• Right to object: You can object to us processing your data for specific purposes (though this may limit Service functionality)
• Right to data portability: Request your data in a machine-readable format
• Right to withdraw consent: Stop using the Service at any time; clear your browser data to remove local storage
• Right to clear BYOK keys: Click the 🔑 button in the AI Helper → "🗑️ Clear All Keys" to remove your API keys from your browser instantly

If you're in the EU, UK, or California, you have additional rights under GDPR, UK GDPR, or CCPA respectively. We honor all of these rights regardless of your location.

11. Children's privacy

The Service is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children.

If you believe a child has provided us with personal information, email support@clickkitfree.com and we'll delete it immediately.

Some tools (like the Legal Contract Generator) are intended for adults and should not be used by minors without supervision.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll:

• Post the updated version on this page
• Update the "Last updated" date at the top
• For material changes (e.g., new data collection, new third-party sharing), post a prominent notice on the homepage for at least 30 days before the change takes effect
• Email users who have provided their email address (license holders, support contacts) about material changes

We will never retroactively change our policy to allow selling your data, training AI on your inputs, or sharing your data with advertisers. If we ever consider such a change, we'll require explicit opt-in consent from every affected user.

13. Contact & governing law

If you have any questions about this Privacy Policy or want to exercise your data rights, email support@clickkitfree.com. Our team typically replies within 24 hours.

For EU/UK/California users, we honor GDPR, UK GDPR, and CCPA respectively. We comply with all applicable data protection laws regardless of your location.

If you're a supervisory authority and need to contact us about a privacy matter, email legal@clickkitfree.com with "Authority inquiry" in the subject line.