Privacy Policy

This policy explains what KeyBark collects and why. We keep it short and we mean it.

Who is responsible

The data controller is KeyBark, London, UK. Contact us about privacy through the contact form at https://keybark.com/contact.

What we collect

• Account data: your email address, a salted PBKDF2 hash of your password (never the password itself), your plan, and how you found us (e.g. a referral tag in the sign-up link).
• Waitlist requests: if you click “Get notified” on a paid plan, the email you give and the plan you picked, used only to tell you when that plan opens.
• Provider keys you add, encrypted at rest (see Security), plus the labels, thresholds and alert email you set.
• Spend data we read from the providers: daily cost totals for the last ~45 days and the alerts we generated.
• Billing data: Stripe customer and subscription IDs. Card details are handled by Stripe, not us.
• Messages you send through the contact form.
• Standard server logs kept by our hosting provider (IP address, user agent, request path) for security and debugging.

Why

To run the service (monitoring, alerts, kill switch if you enable it), to bill you, to reply to you, and to protect the service from abuse. We don't sell your data and we don't use your provider keys for anything except the calls described on the Security page.

Who processes it

• Cloudflare (hosting and storage), Stripe (payments), Google (an internal spreadsheet of sign-up emails used by the operator), and an email delivery provider once email alerts are enabled.
• OpenAI, Anthropic and OpenRouter receive API calls authenticated with the keys you provide.

Retention and your rights

Remove a key at any time from the dashboard and its encrypted copy is deleted. To delete your account, export your data or make any other privacy request, use the contact form from your account email. We aim to respond within 30 days.

Cookies

We use only strictly necessary cookies: a session cookie that keeps you logged in, and a short-lived (10-minute) cookie that keeps your non-secret form entries after a failed “Add key” attempt (never the key itself). No advertising or tracking cookies.

Changes

If we change this policy we'll update the date above and, for material changes, email account holders.