Privacy Policy

API KEY PRO is a product of Chase & Marshal ("we", "us", or "our"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using the Service you agree to this policy.

If you have questions, contact us via our contact form.

Account data. When you register we collect your email address and a bcrypt-hashed password. We do not store your plaintext password at any point.

Encrypted secret ciphertext. When you create a secret, your browser encrypts the plaintext locally and transmits only the resulting ciphertext to our servers. We store the ciphertext blob and its associated metadata (creation timestamp, expiry timestamp, a read flag). We do not store the decryption key. It exists only in the share link you receive and never reaches our infrastructure.

IP addresses. We log the IP address associated with authentication requests and secret creation events for rate-limiting and abuse prevention. IP addresses are stored alongside audit log entries and retained for 90 days.

Session data. We issue a signed, httpOnly session cookie (JWT) when you log in. This cookie contains your user ID and session expiry. It is not readable by client-side JavaScript.

Billing data (Pro accounts). Payment is processed by Stripe. We receive a Stripe customer ID and subscription status; we do not store full card numbers, CVVs, or bank account details. Stripe's privacy policy governs their handling of payment data.

Secrets are stored exclusively as AES-256-GCM ciphertext in our database. The decryption key is a randomly generated 256-bit value that is embedded in the share link (in the URL fragment, after the #). Because URL fragments are never transmitted to the server by browsers, we receive only the ciphertext, never the key.

This architecture means we are technically incapable of reading your secret, even if compelled by law enforcement. We can confirm a ciphertext row exists, but we cannot decrypt it.

Burn-after-read. The moment a recipient opens a secret link, their browser fetches the ciphertext from our API. Our server permanently deletes the database row in the same request cycle. The secret cannot be recovered after that point.

7-day expiry sweep. Secrets that have not been read within 7 days of creation are automatically and permanently deleted by a background sweep job.

Account data. If you delete your account, all associated secrets (whether read or unread), audit log entries, and session records are deleted within 30 days.

Audit logs. Audit log entries (action, actor, IP, timestamp) are retained for 90 days before automatic deletion.

We use a single first-party session cookie named kv_session. It is:

• HttpOnly: not accessible to JavaScript
• Secure: sent over HTTPS only
• SameSite=Lax: mitigates CSRF
• Expires when your session ends (or when you log out)

We do not use advertising cookies, tracking pixels, or third-party analytics scripts.

Stripe. Workspace subscription billing is handled by Stripe, Inc. When purchasing a workspace, you are directed to a Stripe-hosted payment flow. Stripe's Privacy Policy applies to data you provide during checkout.

We do not sell, rent, or share your personal information with any other third parties for marketing purposes.

We use industry-standard measures including TLS in transit, encrypted storage at rest, and role-based access controls on our production database. Our server-side code is designed never to log secret plaintext. This is a system property, not merely a policy.

Depending on your jurisdiction you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your account and associated data
• Data portability

To exercise any of these rights, reach us via our contact form. We respond within 30 days.

We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before material changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

Chase & Marshal
Contact: contact form
Web: chasemarshal.com