Privacy Policy

Datenschutzerklärung · Last updated 30 July 2026

The short version: this website sets no cookies, runs no analytics and loads nothing from any other server. The app records nothing and sends nothing anywhere, apart from asking GitHub whether a newer version exists, which you can turn off. The rest of this page is the detail the GDPR requires.

Controller

This website

Hosting. keychange.dev is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, a subsidiary of Microsoft Corporation. When you open a page, GitHub's servers process the data your browser transmits: your IP address, the date and time of the request, the file requested, the referring page and your browser and operating system identification. This is technically necessary to deliver the site and to keep it secure. The legal basis is Art. 6 (1) (f) GDPR, my legitimate interest in providing this website reliably. I have no access to these logs and do not receive them. GitHub describes its own processing in the GitHub Privacy Statement.

Transfer outside the EU. For users in the European Economic Area GitHub's contracting entity is GitHub B.V., Prins Bernhardplein 200, 1097 JB Amsterdam, Netherlands, but the service is operated from the United States, so this processing involves a transfer to a third country. GitHub has certified to the U.S. Department of Commerce that it adheres to the EU–U.S. Data Privacy Framework Principles, which means the transfer is covered by the European Commission's adequacy decision of 10 July 2023. GitHub states that it additionally relies on the standard contractual clauses published by the European Commission under Commission Implementing Decision (EU) 2021/914.

No cookies, no tracking. This site sets no cookies and uses no analytics, no tag managers and no advertising. It also embeds nothing from third parties: every stylesheet, image, animation and font used on these pages is served from keychange.dev itself or is a font already on your Mac. No request leaves for another company simply because you opened a page.

Links out. The pages link to GitHub and Ko-fi. Those are ordinary links: nothing is sent to them until you click, at which point their own privacy policies apply.

The Keychange app

What it reads, and why it needs permission. Keychange has to know which physical keyboard produced a keystroke, which on macOS requires Input Monitoring permission. It reads which device an event came from and discards the rest. What you type is not recorded, not stored and not transmitted, and there is no logging of keystrokes anywhere in the app. You can verify this in the source.

What it stores. Your keyboard-to-layout mappings and your settings are saved locally on your Mac, in the app's own preferences. Nothing is synced and nothing leaves the machine. Deleting the app and its preferences removes them.

Update checks. If “Check for updates automatically” is switched on, the app asks GitHub for github.com/dennistimmermann/keychange/releases/latest/download/appcast.xml to see whether a newer release exists. That request transmits your IP address and the usual request headers, including the app version, to GitHub. It is the only network request the app makes, and you can turn it off in the settings. The legal basis is Art. 6 (1) (f) GDPR, the legitimate interest in users being able to receive security and bug fixes; if you switch it off, no request is made.

No telemetry. There is no usage analytics, no crash reporting, no unique identifier, no account and no server of mine that the app talks to.

Donations

If you choose to donate, that happens on Ko-fi or GitHub Sponsors, on their websites and under their privacy policies. They are the controllers for whatever they collect. I receive only what their payout reporting shows me, which may include the name or handle you chose to display and any message you sent.

Your rights

Under the GDPR you have the right to obtain information about the personal data held about you (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to have its processing restricted (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). To exercise any of these, email me at the address above.

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, datenschutz-berlin.de.

Changes

If the site or the app starts processing something differently, this page changes with it, and the date at the top changes too.