Your Self-Hosted Tracker Isn't "Just Yours" Anymore: How Keitaro's 2026 Rules Change the Job for Media Buyers

On October 13, 2026, a new edition of Keitaro's Terms of Use came into force — and this is not one of those routine legal updates everyone scrolls past out of habit. The short version: a tracker you install on your own server precisely to stay in control of your infrastructure now, by contract, sends the developer your server's IP address, your connected domains, and the names of your campaigns, offers, and flows. You cannot switch this transmission off. The company can request identity verification and proof of funds at any time, and if you refuse, it can terminate the agreement in 14 days with no refund. Upon a lawful request, user data can be handed over to government bodies, courts, and law enforcement.

For a media buyer, this isn't an abstract "privacy policy" story. It's a direct change to your threat model: a slice of what used to count as private infrastructure is now visible to a third party by default. Below is a breakdown of exactly what changed, why the company did it, how comparable clauses look at other trackers, and what specifically to do before the first email lands in your inbox.

January vs. October: What Actually Changed

The new edition was published on September 29, 2026, with a 14-day transition window. The previous version had been in force since January 31, 2026. Separate US-specific terms that used to sit at their own address are now gone — the rules are unified across all regions.

The key differences are easiest to see side by side:

Clause

There's one genuinely positive shift, and it concerns future editions. Previously the company could amend the agreement unilaterally, with the new version taking effect the moment it was published. Now changes arrive with "reasonable prior notice," and a user who disagrees may terminate the agreement before they take effect. For the current edition that window has already closed — but you can meet the next one prepared. Worth keeping in mind, and a good reason to stop ignoring emails from the vendor.

Operational Telemetry: What Exactly Leaves Your Server

The key new term is Operational Telemetry. These are "pseudonymized technical data" that the software sends to the company's infrastructure on its own, without user involvement. The list in the agreement is open-ended ("including but not limited to"), but the baseline set is named outright:

• the installation identifier (machine_id) plus license-key activation and validation signals;
• your servers' IP addresses;
• domain names connected to the instance;
• technical configuration metadata, including the names the user assigns to campaigns, offers, and flows.

What the text says is not included: creatives, traffic data, targeting parameters, and end-user data. Click and conversion stats stay on your server. On paper it reads tidy — but, as usual, the devil is in the combination of fields.

Telemetry is retained for up to two years. If the data is tied to a suspected violation, a fraud investigation, or a sanctions check, the term extends to three years "or longer if required by law." And the part most uncomfortable for a buyer: telemetry from different installations may be correlated with one another to detect violations and sanctions circumvention. In other words, a domain that surfaces on one installation can be linked to another — even if those are formally "separate" accounts.

One more detail from the updated privacy notice: it states that any data the software processes in connection with your campaigns or traffic "remains solely under your control." The catch is that campaign names and domains, judging by the terms, no longer fall inside that "solely."

Why "Domain + Campaign Name" Is Sensitive Data

Look at your own tracker through an outsider's eyes and the harmlessness evaporates. A domain plus a campaign name is, in effect, a map of the setup: vertical, GEO, traffic source, often the offer and the affiliate program too. Media buyers have spent years naming flows descriptively — gambling_BR_fb_casino_X, nutra_DE_google_offer_Y — because that's how you navigate a hundred live campaigns. Those names used to be visible only to your team. Now a third party reads and stores them for two to three years, with the ability to cross-match and to disclose on request.

For white-hat verticals, this changes nothing. But for anyone running gambling, betting, nutra, dating, and other gray or ad-restricted verticals into GEOs where authorities come after the people behind illegal advertising rather than the ad accounts, it's a new link in the chain that wasn't there before.

"Must Not Be Blocked": The Ban on Disabling Telemetry

A dedicated clause explicitly forbids blocking telemetry transmission. Filtering, spoofing, or otherwise circumventing data transmission and license-key validation is not allowed, and deliberate blocking is named outright as a material breach of contract. If transmission drops for a technical reason (a server goes down, the network fails), the company is obliged to notify you and give you 7 to 14 days to fix it. Decompiling and modifying the code is separately prohibited, as is opening a second account to get around a suspension.

A material breach, under this same edition, is grounds to terminate the agreement without refunding amounts paid — including the unused portion of the paid period. So the familiar "just firewall outbound connections and carry on as before" plan is worth exactly as much as the license itself and access to every installation tied to it.

Who Can Ask About You, and When

The agreement reserves the company's right to comply with lawful requests from government, court, and law enforcement bodies, which may include disclosing a user's data to the relevant authorities. Under the January edition, only aggregated data could be handed over in response to such requests — now it's the data of a specific user.

Whose authorities? The agreement is with the Estonian developer, Estonian law applies, and disputes are heard by a Tallinn court. There is no closed list of "competent authorities" in the text — which means interpretation stays at the vendor's discretion within applicable law.

It's worth being clear-eyed about what the company can actually hand over and what it doesn't hold. Traffic and end-user data, per its own documents, it does not have. What it does have is the chain "this domain and these campaigns → this license → this payer," and after KYC, a specific individual or company as well. The practice of suspending licenses on law-enforcement requests isn't new for this tracker and was discussed publicly as far back as 2024. The new edition merely moves it from interviews and internal procedure into the contract text — and expands it: the company now holds not just the license key but the domains and campaign names too.

KYC/KYB: 7 Days to Respond, 14 to Termination

The company can trigger a check on two grounds: its own discretion, or reasonable suspicion of a breach or of the risks it lists. It may request KYC/KYB, basic or enhanced due diligence. On top of that, it may ask for documents on the source of funds and on the ultimate beneficiary of the tracked ad campaigns, if there's reason to suspect a breach of EU sanctions restrictions or if competent authorities request it. The key point: they ask not only "who are you" but "whose campaigns are these."

How the timeline works:

• the request arrives at the email tied to the account and is deemed received on the day it's sent;
• you get at least 7 calendar days to respond; you may ask once for a further 7-day extension — with justification and before the deadline;
• fail to send everything requested in time, and access to the tracker, account, and keys is suspended until you do;
• if the check isn't completed within 14 days of the original request, the agreement may be terminated and amounts paid become non-refundable (with an active renewal, termination takes effect at the end of the paid period);
• while a check is open, license renewal may be frozen and payments declined or held.

To be fair: an uncompleted check does not, by itself, constitute a finding that you breached the agreement. If the check is passed and there are no violations, the company may extend your paid period to make up for downtime. And if you cooperated but the agreement was still terminated for reasons not on your side, there's provision for a pro-rata refund of the unused period.

The check itself is run by an external provider whose name the documents don't disclose. The company receives the result and a session identifier, keeps no copies of the documents, and the check may include face verification — that is, biometrics — with separate explicit consent. The verification result is retained for three years.

Suspension With No Appeal, Across Everything Connected

The harshest block of the agreement is the section on suspension and termination. The company can block your account, keys, support, and payments immediately and without warning if it "reasonably suspects" fraud, financial crime, sanctions evasion, or false information about yourself — or if your activity creates "legal, regulatory, sanctions, fraud, security, financial or material reputational risk."

Additional triggers include "a request or expectation of a competent authority" and demands from a payment, banking, or infrastructure provider. The company is not required to prove a violation: per the text, a reasonable suspicion or a risk assessment based on the information available to it at the relevant time is sufficient.

What this means in practice:

• Blast radius. A block extends to all accounts, licenses, installations, and services the company deems connected to you commercially, technically, operationally, or through a beneficiary. You won't be allowed to open a replacement account.
• Opacity. Reasons and evidence may be withheld, including communications with authorities. Sometimes you'll be told only a general category.
• No contractual appeal. There is no contractual right to warning, cure, appeal, or reinstatement; the internal decision is final.
• Liability cap. The company's liability to you is capped at the amount of your last license payment.

And one more point worth absorbing separately: a decision may be made without any human involvement. The company uses automated rules and models, and a block may be issued automatically. Among the inputs for that scoring, telemetry, domains, and payment signals are named explicitly.

What's left to the user: if the decision was fully automated and you're an individual, Article 22 of the GDPR lets you demand human involvement, state your case, and contest the decision. Suspicion is enough to suspend, but not enough for a final denial of refund — for that, the company must establish a breach in good faith. Before going to court, a pre-litigation claim with a one-month negotiation window is mandatory.

Why Keitaro Did This

Read only the agreement, and it's easy to conclude this is vendor paranoia. Look at the cybersecurity reports, and the picture changes. For years this tracker has surfaced in them as a traffic distribution system (TDS) through which malicious actors filter and redirect traffic — from investment scams to infostealer delivery.

In autumn 2025 the company published a dedicated Trust & Safety page signed by leadership. It announced three directions: multi-layer user verification, tighter payment checks with the abandonment of high-risk payment methods, and a repositioning — from an "all-in-one advertising platform" to serving exclusively confirmed businesses and registered professionals. The company warned up front that the new measures would add friction for all users. In summer 2026 the policy was amended to spell out zero tolerance for using the software for illegal activity, including cloaking and the misuse of TDS capabilities.

The scale of abuse was laid out by independent researchers: over the four months from the start of October 2025, they counted roughly 15,500 domains behind malicious instances of the tracker. The central finding of their work is that cracked, "nulled" builds play a significant role in the abuse — distributed on forums already pre-activated, bypassing the license check. Certain threat groups, by the researchers' assessment, operate specifically on cracked or stolen licenses.

Seen in that light, the new clauses read differently. Key validation, machine_id, and the correlation of installations are exactly the tools used to tell a legitimate copy from a cracked one and to find a single operator behind dozens of domains. The vendor's target is pirates and malware operators. But telemetry is collected from everyone, and the harsh suspension section catches anyone whose activity the company decides is a risk.

Timeline: How the Tracker Walked Away From Affiliate Marketing

Take the last two years as a whole, and the new rules aren't a sudden pivot but the latest step along a course set long ago:

• Early 2024. Official channels still speak openly in affiliate-marketing language — publishing iGaming offer roundups and top-GEO lists "for the traffic-arbitrage game."
• Summer 2025. The Russian-language user chat "goes on pause."
• Autumn 2025. The affiliate program is shut down — with a promise to relaunch it "in an updated format on new, more favorable and transparent terms."
• Autumn 2025. The Trust & Safety page launches, along with the course toward "confirmed businesses and registered professionals."
• Summer 2026. The Trust & Safety policy is amended with cloaking and TDS clauses.
• Autumn 2026. The new Terms of Use edition drops, the word affiliate disappears from the product description, and on October 13 the rules take effect.

A relaunch of the affiliate program in the promised format never materialized over that period. Transparency, though, genuinely increased — it's just now pointed in the other direction: from the user to the vendor, rather than the reverse.

How Other Trackers Handle This

The clause on disclosing data to authorities is not one vendor's invention. Cloud trackers state plainly in their policies that they may disclose data to courts, law enforcement, and regulatory bodies. Some stipulate that the service isn't for anyone who is the target of sanctions or operates from sanctioned jurisdictions, and declare all payments non-refundable.

But there's a difference that discussions often miss. Cloud trackers, by definition, store all your stats with the vendor — not just campaign names. So moving off self-hosted into the cloud for the sake of privacy is a questionable call: there's less privacy there by design.

If self-hosting genuinely matters to you, then when choosing an alternative, read the contract rather than the marketing page, and look for answers to four questions:

1. Is there a telemetry-from-installation clause, and can it be disabled?
2. Under whose law is the agreement made, and where are disputes heard?
3. What does it say about suspension — is a proven breach required, or is suspicion enough?
4. How do refunds work on termination?

One important caveat: the absence of a telemetry clause in the contract text only means it isn't in the text — not that the software is guaranteed to send nothing. You'll still need to verify outbound-connection behavior yourself.

Checklist: What to Do Right Now

1. Check the email tied to your account. Notifications and verification requests are deemed received on the day they're sent, and the 7-day KYC clock starts from there. An abandoned inbox is now a direct route to a block.
2. Look at your campaign, offer, and flow names through an outsider's eyes. A third party now reads and stores them for two to three years. Switching from descriptive names to internal codes is basic hygiene, and it doesn't break the ban on blocking telemetry: the data leaves as-is, you're not filtering or spoofing anything.
3. Don't touch telemetry or the license key. Firewalling outbound connections, patches, modifications, and cracked builds are a material breach and grounds for termination without refund. Nulled versions are, on top of that, exactly what the entire new control system is built to catch.
4. Prepare your documents in advance. A legal entity or sole proprietorship, proof of source of funds, and a clear picture of who the campaign beneficiary is. If you run traffic for a client or work on a team, you need a contract with them. Seven days fly by, especially if the request arrives mid-campaign.
5. Limit the blast radius. A block hits everything "connected": accounts, installations, domains, payers. Several different projects and legal entities on one license and one payment method means a problem in one place takes down everything at once. Spread your infrastructure out.
6. Plan for the block scenario. If you're blocked, request human review (GDPR Article 22, if the decision was automated and you're an individual), keep all correspondence, and ask on what grounds your money is being held: suspicion alone isn't enough for a final refund denial. A pre-court claim with a one-month negotiation window is mandatory.
7. If you decide to leave, export your data early. Pull your stats and settings before a block, not after. And read the new tracker's contract in full: sanctions clauses and request-based disclosure exist almost everywhere — the difference is in the details on telemetry, the suspension process, and refunds.

The Bottom Line

There's no cause for panic: the vendor, by its own documents, doesn't collect traffic or end-user data, and there was no mass leak of the customer base. But the rules have changed in substance. Self-hosted no longer means "the developer knows nothing about your installation." Domains, IPs, and campaign names go to the company, are retained for two to three years, are cross-matched across installations, and can be disclosed upon a lawful request. Suspension is now possible on suspicion, extends to everything connected, and comes with no appeal.

Where the product is headed, the company has stated itself: toward confirmed businesses and registered professionals. For a white-hat business with a legal entity, the new rules add paperwork and little else. Everyone else should decide, in advance, whether they want to stay inside this system — before an automated scoring model makes that choice for them.