Kiiwi hears a key. Never what you typed.

Kiiwi plays a sound when you press a key, so it needs one macOS permission. This page says what that permission lets it do, what it can't, and exactly what leaves your Mac. The short answer is almost nothing.

The permission, in plain words

macOS calls it Accessibility, and it is a broad permission, which is why the prompt sounds serious. Kiiwi uses it for one job: to know that a key went down so it can play the sound. It listens only. It can't type for you, change a key or click anything. You can switch it off at any time in System Settings, Privacy & Security, Accessibility, and Kiiwi simply goes quiet.

Don't take our word for it

Run a network monitor such as Little Snitch or LuLu while you type. The only host Kiiwi talks to is kiiwi.app, for the licence check and the update list, and neither request carries anything you typed.

The full policy

Last updated 6 October 2026

Everything above, in detail, followed by how this website and checkout handle data.

The app

Keystrokes

Kiiwi uses macOS Accessibility permission to observe key events system-wide. A key event is read only to decide which recording to play, then discarded. It is never written to disk, never buffered, and never transmitted. There is no keystroke log to hand over, subpoena or leak, because there is nowhere one is kept.

Your stats

From version 1.1, Kiiwi keeps typing stats for you, on your Mac only. Each keystroke adds one to a few counters and nothing more:

• Keys per day and per hour, for today's count, the 14-day chart, your streak and your busiest hour.
• Keys per keyboard row (number, top, home, bottom, space, modifiers, return and delete), never per key.
• Keys per sound pack, for your favourite switch.
• Typed characters per app, counted against the app's bundle identifier and name (for example "Terminal"). Never window titles, document names or web addresses.
• Clicks and scroll ticks per day, and your typing speed: the best number of characters in any 60 seconds, worked out from timestamps that are held in memory for one minute and then dropped.

Kiiwi never records which key you pressed, so the stats cannot be turned back into anything you typed. They live in one file, ~/Library/Application Support/Kiiwi/stats.json, and are never sent anywhere. In Settings you can export them as JSON or reset them to zero; a reset keeps one copy beside the file so it can be undone. A share card is an image made on your Mac, and it only leaves your Mac if you post it.

Activation, and the licence check

Kiiwi keeps track of whether its licence is still valid, because that is what lets it run at all. It checks when you activate, each time it launches, and once a day while it is running. Each check sends four things to our activation endpoint:

• Your licence key.
• The id of the seat this Mac holds, so the check confirms this machine's activation rather than only that the key exists somewhere.
• A SHA-256 hash of your Mac's hardware identifier (IOPlatformUUID). The raw identifier never leaves the machine. The hash names the activation so seats can be counted, and cannot be reversed into anything about you or your Mac.
• The app version, so a support email can be answered accurately.

That is the whole of it. The check carries no usage data, no file names, no keystrokes and no identifier for you as a person: it answers one question, which is whether this Mac's seat is still good.

The endpoint relays it to our payment provider, who hold the licence and its activation count, and the result is cached on your Mac so it keeps working offline for 14 days before asking for a connection.

The update check

Once a day, and when you choose Check for Updates, Kiiwi fetches the list of releases from kiiwi.app/appcast.xml. That request carries the app's name and version, as any download does, and nothing about you or your stats. A new version is only installed after you agree to it.

What the app does not do

No analytics, no telemetry, no crash reporting, no advertising identifiers, and no account to create.

This website

The keystroke counter

The playground counts how many keys have been pressed on the page. Your own running total is kept in your browser's localStorage, which never leaves your device. A single site-wide total is incremented in Google Firestore. That number is an aggregate count and carries nothing that identifies you: not which keys, not a session id, not an account.

The live map

The homepage map shows the cities people type from. When your keystrokes are added to the site-wide total, the same count is added to your city, which comes from Cloudflare's lookup of your IP address at /api/geo. What is stored is the city name, its country, its coordinates rounded to about 11 km and a running count. Your IP address is not stored, and nothing ties the city to you: it is one entry shared by everyone who types from there.

Cookies and analytics

This site uses DataFast for analytics. It records the pages you visit, where you came from (the referring site or campaign), your country and city from your IP address, and your browser, device and operating system. It also records a few actions on this site: reaching the pricing section, clicking buy, trying the playground and downloading the app after a purchase.

To tell one visit from the next, DataFast sets two first-party cookies, datafast_visitor_id and datafast_session_id. They hold random identifiers, not your name or email, and are read only by this site. The script also keeps a few counters in your browser's storage, such as when you first visited and how many visits you have made. There is no advertising, no tag manager and no cross-site tracking, and nothing is sold. The analytics script and its data are served through kiiwi.app, and DataFast processes them for us.

Blocking cookies for kiiwi.app in your browser stops your visits from being linked to each other or to a purchase.

Third parties who see your IP address

Loading any web page reveals your IP address to whoever serves it. For this site that is:

• Cloudflare, who host the site and its endpoints (licence activation, checkout, feedback and the map's city lookup).
• Google (gstatic.com, Firestore), for the counter library and the counter itself.
• Amazon CloudFront, which serves the background video.
• DataFast, for analytics, through this site's own address.

Fonts are served from this site, not from a font CDN, so no third party sees you through them.

Buying

Checkout runs on Dodo Payments, the merchant of record. They collect your name, email, billing details and whatever their tax obligations require, and they process the payment. We never receive or store your card details.

From them we receive, and keep, what is needed to support a purchase: your email address, the payment id, your licence key and its activation count. That is held in their dashboard under our account, and is used for delivering the key, answering support and honouring refunds. Nothing is sold or used for marketing.

When a purchase completes, its amount, currency, payment id, customer id and email address are also sent to DataFast, together with the analytics visitor id from your checkout, so we can see which channel led to the sale. It is used for that reporting and nothing else.

The feedback form

What you send through share feedback goes two places, both mine: a record in the same Google Firestore project described above, and an email to me so it actually gets read. The name, email and rating are optional, and leaving them blank sends the message anonymously. An address is used to reply and for nothing else, it is never added to a mailing list, and the feedback records cannot be read from any browser.

The email is delivered by Resend, an email provider, who handle it in transit. There is no third-party form service and no analytics on the form.

The phone trial

On a phone, the pricing card offers a free 3-day trial by email. If you ask for one, your email address, a trial key, when you signed up, when you first activated it, and a hash of that Mac's hardware ID (the same one the licence check uses) are stored in Cloudflare's key-value store. They're used to send the download and key, up to four reminders about the trial, and to stop the same email or Mac starting a second one. Every email has a link that stops the rest. The trial record is deleted a week after the trial ends, and the note that an email has had a trial is deleted after 90 days. The note that a Mac has had a trial (the hardware ID hash only) is kept for about a year, so one Mac gets one trial. The emails are sent by Resend. Your address is never added to a mailing list or shared.

Email

If you email support, that email and its thread are kept so the conversation makes sense later. Nothing more is done with it.

Your rights

You can ask what is held about you, ask for it to be corrected, or ask for it to be deleted, by emailing support. Deletion of purchase records may be limited by the tax and accounting rules our payment provider operates under, and deleting a purchase record also removes the licence it proves, which will deactivate the app.

Data may be processed outside your country, since the hosting and payment services above operate globally.

Children

Kiiwi is not directed at children and collects nothing that would identify one.

Changes

Material changes will update the date at the top of this page. Because the app sends so little, most changes here will be about a service, not about new collection.