Privacy Policy

Effective September 25, 2026

GateKey (gatekey.cc) is the sign-in service for MXT Productions products such as Grraphic and π LIVE. It is operated by MXT Productions ("we", "us"). GateKey does one job: it confirms who you are and tells the MXT services you use. This policy explains what we collect to do that, why, and your choices.

What we collect

Information you give us

• Account details — username, display name, and optionally an avatar URL and bio. You can create several accounts (personas) under one hub; your sign-in methods (password and linked providers) belong to the hub and work for all of them.
• Email and password — if you sign up with email. We store your password only as an argon2id hash; we can't see or recover it.

Information from sign-in providers

If you sign in with Google, GitHub, Apple, Microsoft, Discord, Canva, Slack, Twitch, Spotify, X, Reddit or Facebook, that provider sends us your account ID with them and, depending on the provider and what you approve, your name, email address and profile picture. We also receive OAuth access and refresh tokens, which we store encrypted (AES-256-GCM). Signing in requests only basic profile scopes. If you use an MXT feature that works with a linked account (for example, a tool that reads your GitHub repositories), you will be asked to approve that extra access on the provider's own screen first; we never request more than a feature you use needs.

Security information

• Two-factor authentication — authenticator-app secrets (encrypted), passkey public keys and metadata (such as the device type and name you choose), and recovery codes (stored only as hashes). Passkey biometrics never leave your device; we never receive fingerprints or face data.
• Sessions and devices — IP address, browser user-agent, and sign-in times for each active session, plus a random device identifier cookie used to recognise new devices. We show an approximate location (city and country) worked out from the IP address using a database stored on our own server — your IP address is never sent to a location service. IP geolocation by DB-IP.
• Security log — a record of security events (sign-ins, failed attempts, password and MFA changes) with IP address and user-agent. It never contains passwords, codes or tokens.

How we use it

• To sign you in, keep you signed in, and let you switch between your accounts.
• To tell MXT services who you are when you use them — they receive your hub ID, account ID, username, display name, avatar and whether you used two-factor authentication. They do not receive your password, provider tokens or security data.
• To let MXT features work with a linked account for you. When you use such a feature (for example, listing your GitHub repositories), the MXT app's server asks GateKey to make that request; GateKey calls the provider with your access token and returns only the result. Your tokens never leave GateKey — not to MXT apps, not to browsers, not to anyone. Requests are only accepted from authenticated MXT servers while you're signed in, and only within the permissions you approved. You can stop this at any time by unlinking the account or removing GateKey's access in the provider's settings.
• If you link Discord and install the GateKey Discord app: to send you security alerts by direct message, and to answer the /gatekey commands you run (replies are visible only to you). You can turn alerts off with /gatekey alerts off or in your dashboard.
• To protect your account: detecting suspicious sign-ins, rate-limiting and locking out password guessing, and emailing you about new devices, verification and password resets.
• To operate, debug and secure the service.

We do not sell your information, use it for advertising, or build marketing profiles. We use information received from Google APIs only to sign you in, and our use complies with the Google API Services User Data Policy, including its Limited Use requirements. The same applies to data from every other sign-in provider.

Who we share it with

• MXT services you use — the identity details listed above, the results of provider requests made for features you use (never your tokens), and — if you belong to an organization such as MXT Productions — which of its teams you're on, your role, and your organization account name. MXT Productions operates all of these services; none are third parties.
• Service providers — Oracle Cloud (hosting; our database runs on our own server there) and Resend (sending account emails, which requires your email address).
• Breached-password check — when you choose a password we send the first 5 characters of its SHA-1 hash to Have I Been Pwned. This reveals nothing about your password or who you are.
• Legal — if required by law, or to protect the rights, safety and security of our users and services.

Cookies

GateKey uses only strictly necessary, HttpOnly cookies. There are no analytics, advertising or third-party tracking cookies.

• gk_session — keeps you signed in (30 days, renewed while you're active).
• gk_mfa, gk_pending, gk_oauth — short-lived (5–15 minutes) sign-in steps.
• gk_device — random identifier so we can warn you about sign-ins from new devices.

How long we keep it

• Account and sign-in data: while your account exists.
• Sessions: until you sign out, revoke them, or they expire after 30 days of inactivity.
• Verification and reset links: 24 hours and 1 hour. Sign-in challenges: minutes.
• Security log: kept to investigate account security. When your account is deleted, the log is no longer linked to it.
• Backups: daily database backups are kept for 7 days, then deleted.

Security

Passwords and recovery codes are hashed with argon2id; provider tokens and authenticator secrets are encrypted at rest; session and one-time tokens are stored only as hashes; all traffic uses HTTPS; and the database is not reachable from the internet. No system is perfectly secure, but we treat security as the product.

Your choices and rights

• View and edit your profile, linked sign-in methods, sessions and security settings in your dashboard.
• Unlink a sign-in provider at any time (you can also revoke GateKey's access in that provider's settings).
• Delete individual accounts from your dashboard.
• To get a copy of your data, correct it, or delete your entire GateKey identity, email privacy@gatekey.cc from an address on your account. We'll respond within 30 days.

Depending on where you live (for example the EU/UK under GDPR, or California under the CCPA), you may have additional rights, which we honour.

Children

GateKey is not for children under 13 (or the minimum age in your country). We don't knowingly collect their information; if you believe a child has an account, contact us and we'll delete it.

Changes

If we change this policy we'll update the date above, and for significant changes we'll notify you by email or in the dashboard.

Contact

MXT Productions — privacy@gatekey.cc