# Privacy

**ckrets is in beta (0.9).** This page says what we collect when you use ckrets, why, how long we keep it, and who
else handles it. It covers the Public API, the one running today. The full, exact schedule, with the planned
Enterprise API's beside it, is in [What we keep, and for how long](/docs/limits#what-we-keep-and-for-how-long).

## What we collect

| What | Why | How long |
|---|---|---|
| The secret's value | to deliver it to the recipient you named | until its last reveal, a revoke or expiry; backups clear within 7 days |
| The secret's record and metadata: times, size, policy, the creator (a key id, a CI identity, or a hash of the address), reveals and denials | status, receipts, abuse handling | the record 30 days after expiry; the metadata 13 months |
| Receipt identifiers | so a receipt can be checked against our record | 13 months |
| The access record: IP address, browser, passkey id | only for a lawful request or an abuse report | 30 days for the API |
| A key's record: its id, a hash of the key, its label and scopes, and an email address if you gave one | to run your key | until 31 days after the key's lease ends |
| A request (`/q/`): the prompt the asker wrote and its state | to show the person who is asking | the same as a secret's record |

We never keep a value after its last reveal, we never see a value your client encrypted, and our logs never hold a
value, a key, a token or an `Authorization` header.

## What we do not do

- No advertising, no selling or sharing of data, no tracking cookies.
- No email is sent in the beta; an email address on a key is not verified or used.

## Who else handles it

- **Amazon Web Services** (United States, us-east-2) runs the service: compute, storage, encryption keys and the edge.
- **Cloudflare** is the DNS host for ckrets.ai and provides Turnstile on first-party sign-in pages. It does not see
  API traffic.

## Requests from authorities

What we hold is what a lawful request can get: the metadata and access records above, never a value we have removed or
one we cannot read.

## Your choices

- Revoke a secret at any time with its manage token; its value is removed at once.
- To ask about data tied to your key or address, or to report a problem, use `POST /v1/report` until a contact address
  is published (planned).

This page is a plain-language beta draft and has not been reviewed by a lawyer; a reviewed version replaces it before
1.0. Changes are announced, with their date, in [the changelog](/changelog.md).