Privacy policy
Last updated: 9 October 2026
This policy explains what personal data Play Restore Keys collects, why, how long it is kept, and your rights. The service is provided by Aoken Labs, a sole proprietorship operating under a freelance certificate in the Kingdom of Saudi Arabia ("we", "us"). We are the controller of the data described here. Contact: support@aokenlabs.com.
The short version
- App details you enter (package name, domain, signing-certificate fingerprints, backend and client): Not stored: it is processed and the report is sent back to you. We fetch only the public assetlinks.json on the domain you name.
- We never sell your data, and we do not use advertising trackers.
- Payments are handled by Dodo Payments. We never see your card details.
What we collect and why
| Data | Why | Kept for |
|---|---|---|
| Your email address, if you sign in | To sign you in (links work for 15 minutes, sessions last 30 days), keep your balance of checks, and answer support requests | While you have an account, then as long as tax and accounting rules require for your purchases |
| App details you enter (package name, domain, signing-certificate fingerprints, backend and client) and the results | To do the work you asked for | Not stored: it is processed and the report is sent back to you. We fetch only the public assetlinks.json on the domain you name. |
| Usage records: date, checks used, success or failure | To count the right number of checks, return checks for failed work, and prevent abuse | While you have an account, then as long as accounting rules require |
| Free use: a one-way hash of your IP address with the checks used that day | To give each visitor 10 free checks a day | Deleted when the next UTC day starts |
| If you join the waitlist: your account's email address and the date you joined | To send you one email when we start selling our hosted restore-key server for Firebase Auth apps. Joining is your choice, and you can leave the list at any time on the Play Restore Keys page | Until we send that email or you leave the list, and never more than 12 months |
| Purchase records from Dodo Payments: payment ID, pack, amount | To add the checks you bought to your account and handle refunds | As long as tax and accounting rules require |
| Technical logs: IP address, browser type, request times, errors | Security, abuse prevention and fixing faults | Up to 30 days |
| Support emails | To answer you | Up to 2 years after the conversation ends |
Our legal bases are: performing our contract with you (the service you use or buy), our legitimate interest in security and preventing abuse, and legal obligations (tax and accounting records).
Who else handles your data
| Provider | Role | Data | Location |
|---|---|---|---|
| Dodo Payments Inc. and its group companies (Dodo Payments) | Merchant of record: sells you checks, takes payment, handles tax, invoices and refunds | Name, email, billing address, payment details, purchase history | United States, with group companies in the United Kingdom and India |
| Cloudflare, Inc. | Hosting and security for the app and its stored data; counts page views (daily totals per source only) | IP address and request logs; your account and balance; daily totals of page views and use | Global network, United States company |
| Resend, Inc. (Resend) | Sends the sign-in links we email you | Your email address and the sign-in email | United States |
| Google LLC (Gmail) | Support mailbox where we read and answer your emails | Your email address and the messages you send us | United States |
Dodo Payments is the merchant of record for all purchases: it sells you checks, so for payment data it is a separate controller under its own privacy notice. Some of these providers are outside your country, including in the United States. Where the law requires, we rely on appropriate safeguards for these transfers.
We share data with authorities only when the law requires it.
Counting page views
We count page views per day, as totals only, split by where the visit came from: the website that linked to us (only its name, such as a search engine), or a ref tag in the link. We use no cookies for this and store no IP addresses or anything else that could identify you. When you ask for a sign-in link, the page sends the same source with it. It is kept with the link for at most 15 minutes, never with your account, and only adds one to that source's daily count of new accounts.
Cookies
We use only cookies that are needed for the service: a sign-in cookie, and the cookies the Dodo Payments checkout sets when you buy. No advertising or cross-site tracking cookies.
Your rights
Depending on where you live (including under the Saudi Personal Data Protection Law and the EU and UK GDPR), you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict some processing, and withdraw consent where we rely on it. Email support@aokenlabs.com from the address on your account. We answer within 30 days. You can also complain to your data protection authority.
Deleting your account removes your email and usage records, except records we must keep for tax and accounting.
Security
Data is encrypted in transit and at rest, and access is limited to the systems that need it. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.
Children
The service is for adults (18 or over) and businesses. It is not directed at children.
Changes
If we change this policy, we update the date above, and for significant changes we email account holders before they take effect.