Privacy policy
Effective August 6, 2026
Abilikey is a free, read-only reference for workplace and school accommodations. This explains what we collect, what we don't, and your choices — in plain language.
The short version. No accounts. The accommodation letter generator runs entirely in your browser — nothing you type into it is ever sent to or stored on our servers. We don't sell or share your personal information, and we don't use your data for advertising.
What we collect
Analytics (Google Analytics 4). We use GA4 to understand aggregate usage — which pages are
viewed, general device/browser info, and approximate location derived from your IP address (which is
anonymized). This is tied to a pseudonymous, per-browser identifier stored in a cookie (_ga) —
not your name or email. We have turned off Google Signals, ad personalization, and
cross-device tracking, and we deliberately do not send your search queries to analytics.
Analytics data is kept for a limited retention window and then deleted automatically.
Aggregate server metrics. Our servers record non-identifying, bucketed events (which route was requested, the response status, rough latency, and the hour) to keep the service healthy. These contain no IP address, no search text, no device fingerprint, and no personal identifiers. Our web-server access logs are configured not to record query text either. IP addresses are processed transiently (held briefly in memory) for rate limiting and abuse prevention — they are not stored.
Contact form. If you use our contact form, we collect the name, email, and message you provide so we can respond. These are emailed to us and used only to reply and handle your request (including any DMCA/takedown notice). The form is protected by Cloudflare Turnstile, which analyzes limited browser and device signals (including your IP address) solely to tell humans from bots — see Cloudflare's privacy policy for details.
What we don't collect
We don't store your search queries, tie the pages you view to your identity, keep anything from the letter generator, or collect special-category/health data about you. We run no advertising trackers and build no advertising profiles.
Cookies
We set one analytics cookie (_ga). You can block or delete cookies in your browser, use
private/incognito mode, or install the Google Analytics opt-out add-on. We honor the
Global Privacy Control (GPC) signal where applicable. Browsing the reference and using the
letter generator work fine without analytics cookies.
Who we share with
- Cloudflare — our CDN and security layer. All traffic to the site and API passes through Cloudflare, which processes IP addresses and request metadata to route, cache, and protect the service (including Turnstile on the contact form and script hosting via cdnjs). Cloudflare keeps short-lived operational logs at its edge.
- Google — analytics only, configured as above (no advertising use).
- Our hosting provider — to serve the site.
- Email — to deliver and respond to contact-form messages.
Fonts are self-hosted — viewing our pages sends no font requests to Google or any other third party.
We do not sell or "share" personal information for cross-context behavioral advertising (as those terms are used under California law).
The API & AI assistants
This policy also covers our public API (api.abilikey.com) and MCP connector (mcp.abilikey.com): the same posture applies — no accounts, no stored queries, aggregate metrics only, transient IPs for rate limiting. If you reach Abilikey through a third-party AI assistant or app, that assistant's own privacy policy governs what it collects (including your conversation) before anything reaches us.
Your choices & rights
- Opt out of analytics anytime via browser settings, GPC, or the GA opt-out add-on.
- Contact-form data — email us to access or delete what you submitted.
- Depending on where you live, you may have additional rights (access, deletion, correction). Email us and we'll honor applicable requests.
Children
Abilikey is not directed to children, and we don't knowingly collect personal information from children under 13.
Data retention & security
We keep contact-form messages only as long as needed to respond and to keep records of any takedown requests. We use reasonable measures (HTTPS, least-data collection) to protect information — though no method is 100% secure.
Not advice
Abilikey is informational only — not legal, medical, or HR advice. See our Sources & rights.
Changes
We may update this policy and will revise the date above; material changes will be noted here.
Contact
Abilikey is operated by App Strategist (appstrategist.com). Questions or requests: please use our contact form.