What we store, and what we never store.

Last updated 22 October 2026. KeyShift is built on one rule: we never hold a usable secret.

The free scanner

• Runs only in your browser. The page's security policy (connect-src 'none') stops it from making any network request, so what you paste cannot leave the tab.
• Nothing you scan is saved. No cookies, no analytics or tracking scripts on the scanner page. The only thing it keeps in your browser is your light or dark choice (the word "light" or "dark"), if you press the sun/moon button.
• Raw values are discarded as soon as they are fingerprinted. The box clears itself after a scan unless you untick that option.
• The share card contains only your score, level, counts and provider names. Never fingerprints or characters of a key.

Your account and the app

• Account: your name and email, held by our sign-in provider (Clerk).
• Per key we store only: provider, a one-way fingerprint, the format prefix (like sk-proj), the last 4 characters, the variable name, where it lives (host and project), owner name, rotation dates and policy, playbook progress, and daily dollar amounts you add or your runner sends.
• Never stored: any key value, and any provider admin key. The in-app scanner hashes in your browser exactly like the public one; our server also refuses any submitted field that looks like a live secret.
• Slack: the incoming webhook address you paste is encrypted at rest and used only to send your alerts.
• Payments: handled by Whop. We never see card numbers; we keep only the plan and membership reference.
• Email alerts: sent through Resend to the address you set.
• Deleting: removing a key deletes its record, locations, spend and log. To delete your workspace and account, email us.

Hosting

The site is served as static files. Our host (Vercel) and database host may keep standard request logs (time, page, IP address) for security for a short period; scan contents never reach them because the scanner sends nothing.

Contact

Questions or deletion requests: privacy@usekeyshift.com