PRIVACY POLICY

Effective Date: 31 March 2025
Operator: Andrew Hughes trading as 3rdKey
Contact Email: admin@3rdkey.com

1. Introduction

This Privacy Policy sets out how 3rdKey (“we”, “our”, or “us”) collects, uses, stores, and protects personal data in connection with its services, including the website located at [3rdKey.com] (the “Service”). By using the Service, you agree to the terms of this Privacy Policy.

3rdKey is operated by Andrew Hughes, trading as 3rdKey, based in Tamworth, United Kingdom.

2. Data Collection

2.1. Minimal Data Approach
We collect and retain only the minimum data required to provide the Service. Use of the Service does not require you to provide personal information such as an email address.

2.2. Optional Email Address
If you choose to provide an email address, it may be used for the following purposes:

To send security-related notifications (e.g., login attempts, account access from new devices);
To respond to support inquiries.

We do not use email addresses for account verification or for marketing purposes.

2.3. Technical Data
We store certain session-related metadata required for functionality and security, including:

A Stripe customer ID (for subscription and payment management);
Product metadata (plan name, limits, support duration);
Session identifiers and tokens for secure access.

3. Encryption and Key Handling

3.1. User Keys
We do not store user encryption keys. During login, the user’s keys are split using a randomized algorithm. One part remains in the user’s browser, and the other is stored temporarily on the server. Neither part can be used alone.

3.2. Secure Communication
Communication between the browser and server is encrypted using standard industry protocols and a Diffie-Hellman key exchange, secured via a user-supplied key (the “3rdKey”).

3.3. Encryption Methods
We employ a combination of standard encryption algorithms and proprietary cryptographic methods designed to exceed conventional security measures. Encryption and decryption are performed within the user session and are not possible outside of it.

4. Cookies

4.1. Essential Cookies
We use only essential cookies required for site functionality and session integrity. No third-party, advertising, or analytics cookies are used.

Cookie Name	Purpose	Duration
cookies_acknowledged	Tracks acceptance of cookie notice	1 year
javascript	Confirms JavaScript functionality	Session
sslresults	Verifies HTTPS functionality	1 hour
expected_self, redirected	Used for session flow and page navigation	Session
session_key	Stores one part of session key	Session
session_token	Prevents cross-site request forgery	Session
session_uid	Links to temporary session data in the database	Session
user_uid	Optionally stores user ID for return visits	Optional

5. Payments and Third-Party Processors

5.1. Payment Processing
We use Stripe to process payments and manage subscriptions. When you subscribe or update your plan:

You may be redirected to Stripe-hosted checkout or account pages;
Stripe may set cookies on its domains for security and session control.

5.2. Stored Metadata
We retain your Stripe customer ID and a copy of the product metadata for use in billing, subscription logic, and service display.

For more information, please consult:

6. Communications

6.1. Email Notifications
If you have provided an email address, we may send you communications regarding:

Account activity and security notices;
Responses to support requests.

6.2. Opt-Out
You may disable or change communication preferences in your account settings. Certain system notifications cannot be disabled if an email address is present.

7. Data Retention and User Rights

7.1. Retention
We retain personal data only as long as necessary for the operation of the Service or as required by law.

7.2. Your Rights
You have the right to:

Access personal data we hold about you;
Request correction of inaccurate data;
Request deletion of your account and associated data;
Receive a copy of your data in a portable format.

Requests should be submitted to admin@3rdkey.com. We endeavor to respond within seven (7) business days.

8. International Privacy Compliance

We seek to comply with applicable privacy laws and regulations, including:

The General Data Protection Regulation (GDPR);
The California Consumer Privacy Act (CCPA/CPRA);
The Children’s Online Privacy Protection Act (COPPA).

This service is not intended for use by individuals under the age of 13. If we learn that data has been collected from a child without consent, we will delete it promptly.

9. Updates to this Privacy Policy

We may amend this Privacy Policy from time to time. The updated version will be posted on this page with a revised effective date. If material changes are made, we will notify active users where appropriate.

10. Legal Entity and Contact Information

Operator: Andrew Hughes trading as 3rdKey
Location: Tamworth, United Kingdom
Email: admin@3rdkey.com

3rdKey Terms of Service

Cookie Policy