Privacy Policy

Effective date: July 16, 2026 · Print this policy

1. Who We Are & What This Policy Covers

Shiftkeys Inc. ("Shiftkeys," "we," "us," "our") owns and operates Kickbacks.ai — a wholly owned brand, website, and software of Shiftkeys Inc. Kickbacks.ai shows short, unobtrusive ads inside developer tools while an AI coding assistant is working, and pays the developer who displayed the ad a share of the ad revenue (currently an estimated 50% — see the Terms of Service). This policy explains what personal data we collect through the Kickbacks.ai software and website, how we use and share it, and the choices you have. You must be 18 or older to use the Service (Section 13).

The single most important thing to understand is the two advertising modes, both of which are opt-in choices. Nothing is shared with advertising partners until you sign in and turn on earning — doing so opts you into Private Mode. Boosted Mode is a second, separate opt-in on top of it. Everything we share with advertising partners is governed by the mode you choose, described in Section 6.

2. Where the Service Is Available

The Service is operated from the United States, and personal data we collect is processed in the United States. The Service is available only in jurisdictions where its operation is lawful (see our Terms of Service, Section 3).

If you are located in the European Union / European Economic Area, the United Kingdom, or Switzerland, the Service is available to you with a limited feature set, applied by IP-based geolocation and your sign-up country. What that limit means for advertising and data sharing is described under "Regional limits" in Section 6: at launch you receive first-party Kickbacks.ai ads only, and your personal data does not reach external advertising partners. If we later activate external ad serving for these regions, we will update this policy and provide the notice or consent that applicable law requires before any personal data is shared with advertising partners. The additional rights and protections that apply to you are described below and in Section 22 of the Terms of Service.

If you are in the EEA, the United Kingdom, or Switzerland

Who is responsible. Shiftkeys Inc. (operating Kickbacks.ai) is the controller of your personal data, reachable through the contact channels in Section 17. If this sub-section conflicts with any other provision of this policy, the provision more protective of your personal data controls, to the extent of the conflict.

What we process and why. Because your account operates under the regional limits in Section 6, we process your personal data only to: operate your account and the Earnings Program — measuring the qualifying activity that generates earnings and crediting it (performance of our contract with you); serve internally sourced ads and cap their frequency (your consent, given when you sign in and enable earning; you may withdraw it at any time by turning off earning, which ends ad serving and the associated processing); prevent fraud and abuse and secure the Service (our legitimate interests); meet tax, financial-record, and other legal obligations (compliance with law); and, for anything genuinely optional, your consent, which you may withdraw at any time without affecting prior processing.

Your rights. Subject to the conditions in applicable law, you may ask us for access to your personal data, correction, erasure, restriction of processing, and a portable copy; you may object to processing based on legitimate interests; and you may withdraw any consent. Contact privacy@kickbacks.ai — we respond within one month, extendable by up to two further months for complex requests (we will tell you if so). You also have the right to complain to your data-protection supervisory authority (in the EEA, this may be the authority in your country of residence, place of work, or place of the alleged infringement; in the United Kingdom, the ICO), though we would welcome the chance to address your concern first. Fraud- and abuse-prevention decisions may be made by automated means; where such a decision produces legal or similarly significant effects for you, you have the right to human review, to express your point of view, and to contest the decision, as described in Section 9.7 of the Terms of Service.

Where your data goes. Personal data is processed and stored in the United States. Where a transfer out of the EEA, the UK, or Switzerland requires a safeguard, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision; you may request details at privacy@kickbacks.ai.

3. Personal Data We Collect

We collect the categories below. The chart also describes the categories we collected, and the categories disclosed to advertising partners, in the 12 months preceding the effective date — except supplemental data-provider attributes, which we obtain only from this policy's effective date onward. "Shared for advertising" means disclosed to an advertising partner as described in Section 6 — nothing is shared for advertising outside that section's rules, including its Regional limits (under which accounts in the EU/EEA, the United Kingdom, and Switzerland share nothing with advertising partners).

We do not collect mobile advertising identifiers, phone numbers, or dates of birth. Website analytics, referral measurement, and supplemental data-provider attributes are described in this Section and in Sections 6 and 9. To improve advertising relevance in Boosted Mode, we may supplement what we collect with professional or demographic attributes obtained from third-party data providers (sometimes called data brokers). These attributes feed only the pseudonymous Boosted-Mode advertising profile described in Section 6; they are never obtained for accounts without Boosted Mode enabled, and never for accounts subject to Section 6's Regional limits.

4. What We Do Not Collect

• Your source code or file contents — in any mode. In Boosted Mode only, we collect the limited work-context items listed in Section 3 (file extensions of open files and a repository-name hint), never file contents or your project's structure.
• Your prompts, AI responses, or chat history, unless you turn on Boosted Mode — and then only as described in Section 6.

To time ad display, the software reads your AI assistant's local session files on your device, parsing only session state (which session is active, whether the current turn has finished). In Private Mode none of that content is transmitted to our servers.

5. How We Use Personal Data

• Operate the Service: serve ads, measure the qualifying activity that generates earnings, and credit your account.
• Pay you: payout processing and related tax and financial records (via Stripe).
• Protect the Service: fraud detection, invalid-traffic filtering, rate-limiting, and security.
• Improve the Service and communicate with you about your account.
• Match ads to broad context — under the mode rules in Section 6 only.

6. Advertising Modes & Data Sharing

Earning requires showing ads. For accounts outside the Regional limits below, those ads come from advertising partners, and delivering them requires sharing limited information with those partners. Both modes are opt-in: no sharing happens until you sign in and turn on earning. You can switch modes at any time, and stopping is always available: turn off earning or sign out, and sharing stops prospectively.

Regional limits (EU/EEA, United Kingdom, Switzerland)

For accounts in the regions identified in Section 2, ads are internally sourced and served by us alone: we do not share personal data with advertising partners for those accounts, the Private Mode delivery sharing described below does not occur, and Boosted Mode cannot be enabled. If we later open external ad serving in these regions, we will update this policy and provide the notice or consent that applicable law requires before anything changes. The rest of this section describes accounts outside those regions.

Private Mode (applies when you enable earning)

To deliver an ad, fill the request, filter invalid traffic, and cap ad frequency, we share with the serving ad partner: your IP address only in truncated and/or salted form (reduced or irreversibly transformed before sharing), operating system and user-agent, approximate (city/region) location, and a pseudonymous user/session identifier.

Boosted Mode (a second, separate opt-in)

Boosted Mode is not available to accounts subject to the Regional limits above. If you opt in, we additionally process your recent AI-assistant conversation context on our own servers to build a cleaned, derived interest signal. Before anything reaches a partner, we filter and clean it: credential-shaped content (keys, tokens, secrets) is stripped on your device before sending; on our servers, automated steps remove personal information and rewrite what remains into a generalized interest summary; and where cleaning fails or looks uncertain, the content is discarded. Only the cleaned, derived signal is shared with advertising partners — never your raw prompts or AI responses. The Boosted Mode profile may also include the supplemental attributes described in Section 3.

In Boosted Mode, our advertising partners may also receive a SHA-256-hashed form of your account email together with your pseudonymous ID, used to attribute impressions (so you get paid accurately), subject to the sign-in-related limits in Section 8.

Our filters are best-effort and will not catch everything. Do not enter sensitive information about yourself or anyone else, or your employer's or clients' confidential information, and do not rely on our filtering. Enabling Boosted Mode is your explicit consent to process sensitive information of your own that may appear in your context; that consent cannot cover other people's information — leaving it out is on you.

Partners, sale/share status, and control

Our advertising partners — ad networks, demand platforms, and advertisers — act as independent controllers and are responsible for their own processing under applicable law. Our agreements with them limit use of what we share to advertising-related purposes, and we forward deletion and suppression requests to them where applicable law or an applicable agreement provides for it; we cannot guarantee erasure by partners or their downstream recipients.

Under some U.S. state privacy laws, this disclosure in exchange for ad revenue is a "sale" or "sharing" of personal data. Your opt-out and control mechanics are in Section 10; because sharing is what funds the Earnings Program, opting out of sale/share ends program participation, as described in Section 11.

Withdrawing Boosted consent stops new work-context collection and closes Boosted-Mode sharing prospectively; Private-Mode delivery sharing continues unless you turn off earning or sign out. Retention and deletion of your data — including on account deletion — are governed by Section 14; payout of balances on deletion is governed by the Terms of Service. When you delete your account, we forward deletion or suppression requests to our partners as described above.

7. How We Disclose Personal Data

Beyond the advertising disclosures in Section 6, we disclose personal data only to service providers acting on our instructions, and where the law requires:

• Payment processing — currently Stripe, which collects your payment details directly.
• Infrastructure, authentication, and storage — cloud infrastructure providers acting as our processors, including for the server-side cleaning step in Section 6.
• Transactional email — email delivery providers for account and service messages.
• Website analytics and advertising cookies — only as described in Section 9.
• Legal, safety, and corporate — where required by law or legal process, to protect rights and safety, or in a merger, acquisition, or asset sale (your data remains subject to this policy's promises).

Our providers may change; where a change is material we will update this policy per Section 16.

We do not sell your name or plain-text email address to anyone, and we do not share them with advertising partners.

8. Google User Data

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we:

• Use your Google email and display name only to identify your account and credit earnings.
• Do not use Google user data for advertising, retargeting, or profiling — including in hashed form: accounts whose email we hold only through Google sign-in are excluded from the hashed-email attribution field in Section 6.
• Do not sell, rent, or share Google user data with data brokers.
• Do not use Google user data to train AI or machine-learning models.

9. Cookies & Website Analytics

This section applies to the Kickbacks.ai website only — the software does not use cookies. It is the single, canonical description of the cookies and tracking technologies the website uses; where any other part of this policy refers to website analytics or advertising cookies, it refers back here.

Consent and your control. Strictly-necessary cookies (sign-in, security, and the record of your own cookie choice) are always active because the site cannot function without them; they operate for up to about 12 months. Everything else — analytics and advertising — loads according to your choice and your location:

• In the EEA and the UK, no analytics or advertising cookie is set until you give consent. Our banner offers "Accept all" and "Reject all" with equal prominence, nothing is pre-selected, and the site remains fully usable if you decline.
• In Switzerland we apply the same opt-in banner as a conservative choice; Swiss law provides for notice with the ability to refuse.
• In the United States and elsewhere, analytics and advertising cookies may load by default, but you can reject them at any time, and we honor a Global Privacy Control (GPC) signal from your browser as a valid opt-out without any further action from you (see "Global Privacy Control" in Section 10).

You can review or change your choice at any time — as easily as you gave it — using the Your Privacy Choices control in Section 10. Withdrawing consent stops the relevant cookies from loading on your next page view.

Session replay (Microsoft Clarity). Our analytics category uses Microsoft Clarity, which — in addition to aggregate usage metrics — can record a replay of a visit (mouse movement, clicks, scrolling, and page navigation) to help us diagnose usability problems. We enable Clarity's content masking so that text you type is obscured in these recordings, and we do not run session recording at all on sign-in, account, payment, or support pages. Where opt-in consent is required (see above), Clarity loads only after you consent to analytics; elsewhere it may load by default unless you reject it or your browser sends a GPC signal. Clarity's analytics cookies operate for up to about 12 months. See the Microsoft Privacy Statement for how Clarity processes data.

Advertising measurement. Our advertising category uses advertising pixels from the platforms where we advertise — which may include platforms such as Meta, Reddit, LinkedIn, Google, and/or X — to measure how well our own ad campaigns perform (for example, whether an ad led to an install). These pixels set cookies that typically operate for up to about 3 months, and they share limited event data with the platform and, depending on your jurisdiction, this may be considered "sharing" or "targeted advertising." Where opt-in consent is required they load only after you consent to advertising cookies; elsewhere they may load by default. In every region they are suppressed where you have rejected them or your browser sends a GPC signal. Each platform's own privacy policy governs its handling.

Web fonts. We self-host the web fonts used on the site, so loading a page does not send your IP address to a third-party font service.

We treat "Do Not Track" as unsupported by current standards; the Global Privacy Control signal and the controls in this policy are the operative ones (Section 10).

10. Your Privacy Rights & Choices

Your Privacy Choices
This control opens the website cookie and tracking settings described in Section 9.

Subject to and as provided by applicable law, you may request: access to / a copy of your personal data ("know"), correction, deletion, and opt-out of the sale/sharing of personal data for advertising. Statutory rights vary by jurisdiction — users in the regions covered by Section 2 also have the rights described there — and our request channels are the same for everyone; where your jurisdiction's law does not provide a given right, we may honor the request at our discretion. We will not discriminate against you for exercising rights. Be aware of what opt-out means here: showing partner ads is what the Service does, so opting out of sale/sharing ends ad serving and earning for your account — your account and accrued eligible balance remain, and you can delete the account whenever you wish (Section 11).

If you are a Minnesota or Oregon resident, you may additionally request a list of the specific third parties (other than natural persons) to which we have disclosed personal data.

• In the product: switch to Private Mode to limit sharing to delivery data, or turn off earning to stop sharing entirely.
• Opt-out of sale/share: turn off earning in the product, use the "Do Not Sell or Share My Personal Information" link in the website footer (which opens our request form at kickbacks.ai/privacy-choices, where you select this choice), email privacy@kickbacks.ai, or — for information collected through the website — send the Global Privacy Control signal from your browser (see below).
• Know / correct / delete: the request form at kickbacks.ai/privacy-choices, or email privacy@kickbacks.ai.
• Sensitive personal information: we do not intentionally seek it or use it to build advertising profiles; incidental sensitive content is handled under the filtering, consent, and control terms in Section 6, and switching to Private Mode or turning off earning stops further Boosted-Mode processing.
• Automated decisions and profiling: we do not use profiling to make decisions about you with legal or similarly significant effects, except fraud- and abuse-prevention enforcement; where such an automated decision significantly affects you, you may request human review under Section 9.7 of the Terms of Service.

Exercising your rights

The designated channels for submitting a request are email and our online request form at kickbacks.ai/privacy-choices (reachable from the "Do Not Sell or Share My Personal Information" link in the website footer); the in-product controls described above are additional self-service ways to exercise these choices. We operate exclusively online and have a direct relationship with our users, so no telephone channel is provided.

• Verification. We verify requests by matching the request to the email address on the account, or by a reply-to confirmation from that address. If we cannot verify a request, we will tell you and explain what is missing. We honor opt-out of sale/share requests without verification unless we reasonably suspect fraud.
• Requests and fees. You do not need an account to submit a request. We do not charge a fee unless a request is excessive, repetitive, or manifestly unfounded; if we determine a fee is warranted, we will notify you and explain the decision before completing the request.
• Authorized agents. You may use an authorized agent to submit a request. We require the agent's written, signed permission from you, and we may also confirm the request with you directly.
• Timelines. We will confirm receipt of access, correction, and deletion requests within 10 business days and respond within 45 days, extendable once by a further 45 days where reasonably necessary (we will notify you of any extension). We honor opt-out of sale/share requests within 15 business days.
• Reauthorization. If you opt out of sale/sharing, we will not ask you to opt back in for at least 12 months.
• Appeals. If we deny a request, you may appeal by replying to our decision, by submitting the request form at kickbacks.ai/privacy-choices (choose "Appeal"), or by emailing privacy@kickbacks.ai with "Appeal" in the subject; a person not involved in the original decision will review it. If your appeal is denied, you may contact your state Attorney General or data-protection regulator.

California "Shine the Light." Under California Civil Code §1798.83, California residents may ask us to prevent, or to describe, any disclosure of personal data to third parties for those parties' own direct marketing purposes, by emailing privacy@kickbacks.ai.

Global Privacy Control (GPC). Our website honors the Global Privacy Control browser signal as an opt-out of the sale or sharing of information collected through the website: when your browser sends GPC, analytics and advertising cookies are disabled for that browser, and the cookie banner cannot override the signal (Section 9). The Kickbacks.ai software cannot receive browser signals; there, your in-product mode and earning settings are the controls (Section 6). GPC is the browser privacy signal we support; we do not participate in the IAB TCF or GPP frameworks.

11. The Earnings Program (Financial Incentive)

The Earnings Program pays you a share (currently an estimated 50%) of the ad revenue your displayed ads generate. It is funded by the advertising disclosures in Section 6 — participation and ad-data sharing are inseparable: the program cannot pay you without measuring and monetizing ad delivery. Opting out of sale/sharing therefore ends participation and future earnings accrual (accrued eligible balances are still paid out under the Terms of Service, Section 6). Joining is opt-in; you may withdraw at any time in the product (turn off earning in the mode panel) or by submitting the request form at kickbacks.ai/privacy-choices.

Notice of Financial Incentive (California; Colorado and New Jersey where applicable)

What the incentive is. The Earnings Program pays you a share — currently an estimated 50% — of the net advertising revenue attributable to ads displayed on your device. In short: earnings accrue on qualifying impressions and other earning-eligible engagement actions; once payouts are enabled for your account, they are disbursed periodically through our payment processor when your balance exceeds the then-current Payment Threshold (currently US $10.00, subject to change), subject to fraud screening and the other payout and forfeiture conditions in the Terms of Service, Section 6, which states the authoritative accrual, payout-schedule, and threshold rules and controls if this summary and the Terms differ.

What personal information is implicated. Succinctly: identifiers (a pseudonymous account or session ID; your IP address only in truncated and/or transformed form; and, in Boosted Mode for accounts not signed in with Google, a hashed form of your account email), internet or other network activity (ad delivery and interaction events, device and user-agent data), approximate (city/region) location, and — in Boosted Mode only — inferences (a derived, pseudonymous interest profile) together with the work-context data we process internally to derive it and any supplemental professional or demographic attributes included in it; payment and payout data is used to administer earnings but is not shared with advertising partners. The full category chart and the per-mode sharing rules are in Section 3 and Section 6, which control if wordings differ.

How to opt in and out. You opt in by creating an account and enabling earning, as described in Section 6. You may withdraw at any time by turning off earning in the product, or by submitting the request form at kickbacks.ai/privacy-choices — withdrawal ends the data sharing and future earnings together; accrued eligible balances are still paid out under the Terms of Service, Section 6.

Good-faith value estimate. We estimate the value of a participating user's data to us at approximately $75 per participating user per year, net of the expenses we incur operating the program. Method: aggregate program advertising revenue divided by active participating users, annualized from a stabilized recent period. This is reasonably related to the incentive we pay because the incentive is the program's revenue share of that same revenue.

Colorado and New Jersey (where applicable). The Earnings Program may constitute a "bona fide loyalty program" under the Colorado Privacy Act, or a loyalty, rewards, or discount program under New Jersey law, in connection with the processing of personal data described in Section 6. Its material terms are those described in this Section and in the Terms of Service, Section 6; you join by creating an account and enabling earning, and you may withdraw at any time as described above.

12. Nevada Residents

Nevada law (NRS 603A) gives Nevada residents the right to direct an operator not to sell certain covered information. Because we receive ad revenue in exchange for disclosures that include user data (Section 6), some of our sharing may constitute a "sale" under Nevada's definition. Nevada residents may submit a verified opt-out request through our designated request address: privacy@kickbacks.ai, with the subject line "Nevada Do Not Sell Request" and the name and email address associated with your account. We verify requests by reasonable means — matching your request to your account email or a reply-to confirmation — and will respond within 60 days of a verified request; if reasonably necessary, we may extend by up to 30 additional days and will notify you of the extension. Exercising this right ends Earnings Program participation as described in Section 11.

13. Personal Data of Children

The Service is for adults. You must be 18 or older to create an account, and sign-up requires an affirmative "I am 18 or older" attestation. The Service is not directed to children, and we do not knowingly collect personal data from anyone under 18 — if we learn we have, we terminate the account and delete the data, including any derived profile. We do not knowingly sell or share the personal data of consumers under 16.

For parents and guardians. If you believe a child under 18 has created an account or that we hold personal data about a child, email privacy@kickbacks.ai with the account email address. We will verify your request, terminate the account, delete the associated personal data as described in Section 14, and forward deletion requests to our advertising partners under Section 6. Any balance on such an account is handled under the Terms of Service.

14. Data Retention

We keep personal data while your account is active and afterward only as long as needed for the purposes in this policy: fraud prevention, financial reconciliation and tax records, resolving disputes, and legal compliance. Abandoned balances are handled in accordance with applicable unclaimed-property laws. When you delete your account, we first pay out any balance eligible for payout, then delete or de-identify your personal data, retaining only the records we are required or permitted to keep for financial, tax, fraud-prevention, dispute-resolution, unclaimed-property, and legal-compliance purposes. Aggregated or de-identified data we retain is kept in a form not reasonably capable of identifying you, and we do not attempt to re-identify it.

15. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data, including controls governing access and advertising-partner disclosures. No system is perfectly secure; Section 6's warnings about sensitive content apply.

16. Changes to This Policy

We may need to change this policy from time to time. When we do, we will update the effective date above, and we will alert you to material changes by placing a notice on the Kickbacks.ai website, by sending you an email, and/or by some other means (for example, a notice in the product). Please note that if you've opted not to receive legal notice emails from us (or you haven't provided us with your email address), those legal notices will still govern your use of the Service, and you are still responsible for reading and understanding them. Except where our Terms of Service (Section 20.2) or applicable law require advance notice or your affirmative consent for a change, if you use the Service after any changes have been posted, that means you agree to all of the changes.

17. Contact Us

Privacy questions and requests: privacy@kickbacks.ai (monitored and tracked). General support: support@kickbacks.ai.

Shiftkeys Inc. · United States