Last updated: August 29, 2026
This notice explains what information the KeyTiler website handles when you read a page, download a Preview, or send a contact request.
1. Scope and operator
KeyTiler is maintained and operated by Qiu Yu Zhou, an individual. The website has no account system and does not turn visitors into tracked profiles.
The contact request feature described below is not enabled yet; until it is, the website creates no contact request records.
2. No website analytics
The website does not use access, conversion, or marketing analytics. It has no advertising pixels, session replay, marketing trackers, or email subscription list, and it never uses contact requests for marketing.
Reading a page is not an analytics event: ordinary requests still have to reach the site’s infrastructure, but that traffic is not connected to any analytics product.
3. Language routing
Pages use stable /en/… and /zh/… URLs; /zh/ holds Simplified Chinese. The site does not create /zh-CN/, /zh-TW/, or other language-variant URLs.
- When you open an unprefixed entry, a small in-page script reads your browser’s language preference once and takes you to the matching /en/… or /zh/… page. No language cookie is set, and no language state is stored.
- Explicit /en/… and /zh/… links are never rewritten; query parameters stay with the equivalent page.
- Technical paths such as
/download/<filename>,/api/*, and/updates/*keep their original form.
Your language preference only chooses a page URL. It is not a stable identifier and is not used to infer who you are.
4. Downloads and protection
The homepage download dialog lets you get the current Preview DMG without an account.
- Cloudflare Turnstile checks that the request comes from a real browser.
- After the check passes, the server issues a short-lived, one-time download ticket, and the browser uses it to fetch the DMG from protected storage. No permanent direct download link is exposed.
- Download protection is an abuse-mitigation measure, not an account, identity check, license, or subscription.
- Like any web request, a download involves network information such as your IP address and request time, which the site’s providers process to deliver it. Turnstile only guards this flow; it is not analytics.
5. Contact request fields and handling
Once enabled, the Contact page will accept one of five contact reasons (compatibility issue, product suggestion, product support, privacy request, or terms/licensing question), a description, optional KeyTiler and macOS versions, an optional email address, and the language of the page you used.
- The form does not accept attachments, screenshots, logs, user-agent strings, or device fingerprints.
- To protect the endpoint, the server may verify the request with the source IP and a Turnstile token. Neither is stored with your message.
- Records are kept in a private database that stores only the submitted fields and a creation time. There is no public inbox, public dashboard, or automatic GitHub issue.
Submitting a contact request will not require an email address. The success response is a generic confirmation and does not promise a reply. If you choose to leave an email, the operator may contact you manually from a support mailbox; it is never used for marketing.
Please do not include passwords, private signing credentials, screenshots, logs, or other sensitive material in the description.
6. Contact request retention and access
Contact request records are kept for up to 12 months and are deleted automatically once that boundary is reached.
- Only the operator’s private workflow can read or update the processing status of a record.
- There is no public backend or search, and no automatic synchronization to GitHub Issues.
- There is no automatic receipt email. Only a person who voluntarily provides an email may receive a manual reply.
7. Requests and changes
Depending on applicable law, you may have rights to access, correct, delete, restrict, or object to the processing of personal information, and to withdraw consent where it applies. The operator may need limited information to locate and verify a request; do not send passwords or private signing credentials.
This notice may change when the website, its protections, providers, or applicable requirements change; the last-updated date above changes with each revision. This page describes the site’s current practices and is not legal advice.