Privacy Policy

Summary

The plugin records your keyboard and mouse input only between the press that starts a recording and the press that stops it, saves that recording in the settings of that Stream Deck key on your PC, and plays it back when you press the key. It sends nothing to us or to anyone. It has no account, no online service, no analytics and no telemetry, and it makes no network requests of its own.

A recording is saved as plain data on your PC

• A recording is the list of keys you pressed and released (key codes, not letters), the mouse buttons and wheel turns with their positions on the screen, mouse movement if you selected it, the time between them, and the file name of the program each one went to (for example notepad.exe), plus the position of the first window.
• It is saved without encryption in the settings of that key, which the Stream Deck app keeps in your Stream Deck profile on your PC. Anyone who can read your profile files, or who receives a profile you export and share, can work out what was typed during the recording. Do not type passwords or other secrets while recording.
• Delete a recording with Delete recording in the key's settings, or by removing the key. Copying the key copies its recording.

The keyboard and mouse hooks, in plain words

To record input, and to notice when you take over while a macro plays, a program has to ask Windows to show it keyboard and mouse events (a "low-level hook", SetWindowsHookEx with WH_KEYBOARD_LL and WH_MOUSE_LL). The same Windows feature can be misused to spy on typing, so here is what this plugin does with it:

• The hooks exist only while a macro records or plays. At any other time no hook is set and the plugin is shown no input at all.
• The hooks live in a small separate process of the plugin (file bin/macrohook.cjs). While recording, it keeps each input in memory until you stop; then it hands the whole recording to the plugin once, which saves it as described above. Input that another program sends (Windows marks it as injected) is not recorded.
• While a macro plays, the hooks look only at whether an input came from a person or was sent by a program. Input from a person stops the macro; the input itself is passed on and not kept.
• Once a second while a hook is set, the process sends one made-up key release with a key code that no keyboard has (0xE8) and checks that its hook receives it, so it knows Windows still calls the hook.
• When the plugin ends, the process lets go of any key or mouse button a macro was holding, removes its hooks and exits.

What else the plugin does on your PC

• While playing, it sends the recorded input with the Windows function SendInput, as a keyboard and mouse would. It asks Windows which program's window is in front, and which window is at the point of each click, to compare the program's file name with the recording (Check). With Position Window it reads the position of that program's windows and brings one to the front.
• It changes no Windows setting, installs nothing and does not read or modify the memory or files of other programs. To learn a program's file name it asks Windows through a query-only handle.
• It talks only to the Stream Deck app on the same PC, through a local connection (127.0.0.1) that the Stream Deck app provides to every plugin.

Where data goes

Purchases

The plugin is sold on the Elgato Marketplace. Purchases, payments and licenses are handled by Elgato (Corsair) and its payment provider under Elgato's own terms and privacy policy. GRAMSHIFT never receives card details. If Elgato provides us with sales records (for example the date, country and amount of a sale), we use them only for accounting and tax.

Support requests

If you contact us, we receive what you choose to send (for example your email address, your message and any screenshots). Please do not send us a profile or settings file that contains a recording with private typing. We use what you send only to answer you. Email to contact@gramshift.com is forwarded by our email forwarding provider (ImprovMX) to a mailbox hosted by Google (Gmail), so those providers process support emails on our behalf.

Our role and legal basis

The plugin works only as a tool on your own computer: GRAMSHIFT does not receive or process anything from it. For sales records and support emails, GRAMSHIFT is the controller. We rely on our legitimate interest in answering requests and on legal obligations (for example tax records). GRAMSHIFT is based in Japan, so this information is processed in Japan and by the providers named above.

Your rights

You can ask us to access, correct or delete personal information we hold about you, or object to its use, by emailing contact@gramshift.com. If you are in the EEA or the UK, you can also complain to your local data protection authority.

Retention and deletion

The plugin keeps nothing of its own except its key settings (with the recordings) and log file, on your PC. Deleting a recording or a key removes that recording; uninstalling the plugin and removing its keys removes the rest. Support emails are kept only as long as needed to handle the request and meet legal obligations; you can ask us to delete them. Sales records are kept for up to 7 years for accounting and tax.

Changes

If the plugin ever starts to send or store other data, this policy will be updated before that change is released, and the date above will change.

Contact

GRAMSHIFT · contact@gramshift.com · 1-10-8 Dogenzaka, Shibuya Dogenzaka Tokyu Bldg 2F-C, Shibuya-ku, Tokyo 150-0043, Japan