PRESETKEY
Privacy
Effective September 18, 2026.
PresetKey is two things: an extension that runs inside Premiere Pro on your own computer, and presetkey.com, which issues licence keys, takes payment and brokers the account connections Cross Upload uses. This policy covers the private beta and the released app. Where the two differ they are set side by side below, and every section after that applies to both.
Private beta
A beta licence key is either sent to you by PresetKey or redeemed with an invite code at a $0 checkout. No payment is taken. presetkey.com stores the key, its status, the email address if the checkout collected one, the opaque device identifiers used to enforce the two device limit, the activation date and the time of the last check. The panel sends the key and the device identifier when it activates and each time it checks the key.
Bug reports. Nothing is sent until you press send under Settings, Report a bug. A report carries your message, the email address if you typed one, the section you picked, your licence key and device identifier, the PresetKey build and helper version, your operating system version, processor architecture, Premiere Pro version, screen size and interface scale, and the last lines of the panel, helper and operations logs. Before sending, the panel removes other licence keys, access tokens and values labelled as a secret or password from those logs. A report that cannot be sent is saved on your computer and sent the next time the panel opens. PresetKey reads reports to fix bugs. Each report is stored on presetkey.com, and a copy with the logs attached is emailed to ibra@presetkey.com, the support inbox. You can also email a bug report there yourself.
The beta build does not include Auto-captions or Cross Upload, so neither one reads, processes or sends anything during the beta.
Released app
A licence is bought through Stripe Checkout. Stripe collects the payment details, and PresetKey never receives or stores a full card number. presetkey.com stores the email address the licence was issued to, the plan, the Stripe customer and subscription identifiers, the renewal date of a subscription, the licence status, the opaque device identifiers used to enforce the two device limit, the activation date and the time of the last check. Resend delivers the licence email.
This data is used to issue, activate, verify, recover and support a licence, to end a subscription’s access when it lapses, to switch a key off after a full refund, and to protect it from abuse. It is not sold.
Bug reports work as they do in the beta and carry the same fields. Auto-captions and Cross Upload are part of the released app, and what each one handles is set out below.
Requests to presetkey.com
Requests to the site API are rate limited by IP address. Those counters are held in memory and are never written to the database. presetkey.com runs no analytics, no advertising trackers and no third party tags.
On your own computer
The panel keeps your profiles, your key bindings and any tokens it holds under %APPDATA%\HyperKey. Auto-captions transcribes the audio of your sequence on your computer, and the audio is not uploaded anywhere. The first time it runs, the speech model files are downloaded from Hugging Face, and the captions installer downloads Python, its packages and ffmpeg from their public download sites. JumpCut reads and cuts your timeline inside Premiere Pro and sends nothing off your computer.
Connected accounts for Cross Upload
Cross Upload publishes a marked range of your timeline to TikTok, YouTube or Instagram. It is not in the beta build; it ships when those three platforms have approved the app. You connect each account yourself, and PresetKey asks for the narrowest permission that lets it post. What the feature does, step by step, is on the Cross Upload page.
YouTube. One scope, https://www.googleapis.com/auth/youtube.upload, which allows uploading a video and nothing else. Connecting from presetkey.com additionally requests openid and email, and the email address is used only as the label on the connected row so that two channels can be told apart. PresetKey does not read your channel, your videos, your analytics, your comments or your subscribers. An upload only grant does not return your channel name, which is why the row can show an email address instead.
TikTok. Three scopes. user.info.basic returns your display name and avatar so the row has a label. video.upload sends the clip to your TikTok inbox as a draft you finish in the TikTok app. video.publish posts it directly, and is used only once TikTok has approved the app; until then every post arrives as a draft.
Instagram. Two scopes. instagram_business_basic returns your handle and account type, and instagram_business_content_publish creates and publishes the Reel. PresetKey does not read your feed, your followers, your comments or your messages. Instagram allows only Professional accounts to publish through an app.
No other platform data is read or written. Nothing about a connected account is used for advertising, profiling or training a model, and no platform data is sold or shared with anyone other than the platform the post is going to.
Where the tokens are kept
Connect inside the panel and the access and refresh tokens are written to a file in your own Windows user profile, %APPDATA%\HyperKey\crossupload\accounts.json. They are never sent to us. Connect on presetkey.com and the site keeps them instead: each token is encrypted with AES-256-GCM before it is written to the database and is stored against your licence, and the panel asks the site for a short lived access token each time it uploads rather than holding a refresh token itself.
How this data is protected
This app handles three kinds of sensitive data: the OAuth access and refresh tokens of a connected TikTok, YouTube or Instagram account, the clip on its way to the platform you picked, and the licence and bug report rows presetkey.com keeps. These are the mechanisms that protect each one.
In transit. Every call between the panel, presetkey.com and a platform’s API is HTTPS over TLS, and the certificate is checked by the operating system’s own TLS stack. One address is not HTTPS: the loopback callback the panel listens on while you sign in, http://127.0.0.1 on a port it picks for that one connection. That traffic never leaves your computer, and a loopback redirect is the method Google documents for an app installed on a desktop.
At rest on presetkey.com. An access or refresh token is encrypted with AES-256-GCM before it is written to the database. The key is an environment secret on the host: it is not in the repository, and it is not in the database beside the rows it opens. GCM authenticates as well as encrypts, so a row that has been altered fails its tag and is refused rather than used. Licence rows and bug reports sit in the same managed Postgres database, reached over TLS with credentials held the same way.
At rest on your computer. The panel writes tokens only inside your own Windows user profile, which Windows keeps to your account and the machine’s administrators. Nothing in PresetKey copies that file anywhere else. The folder it sits in is deliberately left out of the profile packer, so a .pky pack you share with someone can never carry a token, and the panel strips access tokens, other licence keys and secret-named values out of the logs before a bug report is sent.
A sign-in that cannot be replayed. The panel’s own connect uses PKCE with S256, so an authorization code intercepted on the way back is useless to anything else. On presetkey.com the OAuth state is a short lived ticket signed with HMAC-SHA256, so a callback can only land on the licence that started it.
Who can reach it. Nobody at PresetKey can read your tokens. The key desk shows licences and bug reports and has no screen that decrypts one. The only thing that ever receives a decrypted token is the panel, on a device your licence has activated, one short lived access token at a time, for the upload it is about to make. Support works from what you write in an email.
If it goes wrong. If PresetKey finds that connected accounts, licence rows or bug reports have been exposed, it revokes the platform tokens it holds so a stolen copy stops working, emails the address on the licence within 72 hours of confirming it with what was taken, and says the same on presetkey.com.
Video you publish
Premiere renders the clip on your computer. YouTube and TikTok receive the file straight from your computer, and no copy passes through presetkey.com. Instagram fetches a Reel from a public link instead of accepting a file, so on that path the panel uploads that one clip to presetkey.com storage at a link that cannot be guessed, Instagram fetches it, and the panel asks for the copy to be deleted as soon as the post exists, on the success path and the failure path alike. The upload link it is issued expires after 30 minutes. The title, caption and privacy setting you type are sent to the platform you picked and nowhere else.
Google user data
PresetKey’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The YouTube part of Cross Upload is a YouTube API Service. Using it also means agreeing to the YouTube Terms of Service, and Google handles the data it receives under the Google Privacy Policy. You can revoke PresetKey’s access to your Google account at any time at myaccount.google.com/permissions.
How the tokens of a connected Google account are protected in transit, at rest and in use is set out under How this data is protected above, and it applies to Google user data the same as to everything else on this page.
Who else processes this data
Stripe processes payments. Resend delivers the licence email and emails each bug report to the support inbox, which IONOS hosts. Vercel hosts the site and the temporary media store the Instagram path uses. The licence records and bug reports live in a managed Postgres database. Each of them receives only what it needs to do that job.
How long it is kept
A licence record lives until you ask for it to be deleted, in the beta and after release. A connected account row lives until you disconnect it or the licence is deleted, and the database deletes those rows together with the licence. A bug report and its emailed copy are kept until you ask for them to be deleted, and a deletion request covers the reports sent with your key and their copies. A staged Instagram clip lives for the length of one post. The steps, and what each one clears, are on the data deletion page.
Changes to this policy
When this policy changes, the effective date at the top changes with it. A change to what PresetKey collects or how it uses it is posted on presetkey.com before it applies.
Contact
Questions, bug reports and deletion requests go to ibra@presetkey.com.