Privacy policy

Your Mac login password stays in that Mac's local Keychain. It is never sent to a phone, watch, Cloudflare, Paddle, or the licensing service.

The licensing service processes only the email, Paddle customer and transaction IDs, license ID, a non-reversible activation-code verifier, the SHA-256 hash of a random installation ID, the device name you provide, and activation times required to fulfill the order.

To provide activation-code recovery, delivery monitoring, and incident handling, the service also stores the email provider message ID, a SHA-256 digest of the recipient address, message type, delivery or bounce status, event timestamps, and short error summaries. Activation codes, passwords, API keys, and email bodies are never written to logs.

The order and license console uses Google OAuth to authenticate administrators and allows access only to a fixed email allowlist. Administrator sign-in creates an encrypted session cookie lasting no more than eight hours. ShuKey never receives or stores the administrator's Google password.

The service does not collect Mac passwords, hardware serial numbers, Apple IDs, usernames, MAC or Bluetooth addresses, pairing private keys, Pair IDs, or unlock history.