KeyForge

Privacy Policy

Last updated: 18 June 2026

This policy is governed by the Protection of Personal Information Act 4 of 2013 (POPIA), South Africa.

Who We Are

Responsible Party: ShellRick Tech Pty (Ltd), South Africa

Information Officer: Frederick Niekerk — freddy@shellricktech.co.za

KeyForge is a free, browser-based developer utility. We do not operate a user database or back-end that stores your inputs.

Personal Information We Collect

We collect the following limited personal information:

  • Usage data — page views, session duration, device type, and country via Google Analytics 4. IP addresses are anonymised before being sent to Google. This data is aggregated and is not linked to a named individual.
  • IP address (CSP violation reports) — if your browser detects a Content Security Policy violation, it may automatically send a technical report to our /api/csp-report endpoint. These reports contain your IP address and browser/URL details. They are written to server logs only and are not stored in a database.
  • Cookie consent preference — your accept or decline choice is stored in your browser's localStorage under the key devutils_cookie_consent. This never leaves your device and is not transmitted to us.

Your encryption keys, plaintext inputs, and ciphertext outputs are never transmitted to our servers. All cryptographic operations run locally in a Web Worker in your browser and are discarded when you close the tab.

Purpose of Processing

We process personal information only for the following specific purposes:

  • Analytics — to understand how the site is used in aggregate so we can improve it.
  • Advertising — to display relevant advertisements via Google AdSense in order to fund the free service.
  • Security — to detect and respond to Content Security Policy violations that may indicate an attack against the site.

We will not process your personal information for any purpose incompatible with those stated above.

Grounds for Processing

Under POPIA, we process personal information on the following grounds:

  • Consent (Section 11(1)(a)) — analytics and advertising cookies are only activated after you explicitly accept via the cookie consent banner.
  • Legitimate interest (Section 11(1)(f)) — CSP violation logging is necessary for the security and integrity of the site.

Cookies and Local Storage

KeyForge sets no HTTP cookies of its own. Third-party cookies may be set by:

  • Google Analytics — sets _ga and _ga_* first-party cookies to distinguish sessions. Only activated after consent.
  • Google AdSense — sets third-party cookies for ad personalisation. Only activated after consent.

Your consent preference is stored in localStorage (not a cookie). You can change it at any time using the Cookie preferences link in the footer.

Operators (Third-Party Processors)

We share data with the following operators as defined under POPIA:

  • Google LLC — provides Google Analytics and Google AdSense. Data may be processed outside South Africa. Google relies on Standard Contractual Clauses as a cross-border transfer safeguard. Google Privacy Policy
  • Vercel Inc. — hosts the site and processes HTTP request logs (including IP addresses). Data may be processed outside South Africa. Vercel Privacy Policy

We have concluded, or rely on, appropriate data processing agreements with each operator as required by POPIA Section 21.

Cross-Border Transfers

Both Google and Vercel process data in the United States and other countries outside South Africa. We satisfy the cross-border transfer conditions under POPIA Section 72 by relying on operators who have adopted binding corporate rules or equivalent contractual safeguards that provide a comparable level of protection to POPIA.

Retention

  • Google Analytics data — retained for 14 months.
  • CSP violation logs — retained for Vercel's standard log window (1–7 days on the free plan).
  • localStorage preference — retained in your browser until you clear it or change your preference.

We do not retain personal information longer than necessary for its stated purpose.

Your Rights Under POPIA

You have the following rights under POPIA:

  • Right of access (Section 23) — to request what personal information we hold about you.
  • Right to correction or deletion (Section 24) — to request that inaccurate, irrelevant, or out-of-date information be corrected or deleted.
  • Right to object (Section 11(3)) — to object to the processing of your personal information on legitimate interest grounds at any time.
  • Right to withdraw consent (Section 11(4)) — to withdraw consent at any time without affecting the lawfulness of prior processing. Use the Cookie preferences link in the footer.
  • Right to complain — to lodge a complaint with the Information Regulator if you believe your rights have been violated.

Because we hold no user accounts or databases, most requests can be fulfilled by clearing your browser storage and opting out of Google services directly. For formal requests, contact our Information Officer.

Information Regulator

You may direct complaints or enquiries to the South African Information Regulator:

Changes to This Policy

We may update this policy from time to time. The Last updated date at the top of this page will reflect any changes. Continued use of the site after a change constitutes acceptance of the revised policy.

Contact

For privacy queries or to exercise your rights, contact our Information Officer:

← Back to KeyForge