1. What we store
- Your account: your email address once you verify it, the public part of your passkeys, and a fingerprint (hash) of your management token. We never see or store your passkey's private key or the token itself.
- Your team: the names members enter when they join, their roles, and their passkeys' public keys.
- Your keys: each key's label, provider, rules, and the real API key, encrypted with AES-256-GCM under keys that never leave our servers. We store only a fingerprint of each ghost key.
- Activity: for each request made with a ghost key, the time, method, path, whether it was allowed and why, the amount and currency of payments, the provider's status code, how long the provider took, and the AI tokens it reported. We also store the IP address the request came from, the country that address belongs to, and the client's user agent (for example "Stripe Node SDK"), so you can see where a key is used and enforce address and country rules. We do not store request or response bodies, query strings, or other headers.
- Usage patterns: for each key, the countries and networks (the first part of an IP address) it has been used from, and security signals such as "first request from a new country". This is how Vallkey spots a leaked key.
- Messages you send us: through the contact form, your name if you give it, your email address, your message and, from the dashboard, which account it is about.
- Audit log: who changed what in your account (keys, rules, team, settings) and when.
- Abuse protection: IP addresses and email-address fingerprints in short-lived rate-limit counters, kept for about an hour.
2. Where we store it
You choose where your account's data lives when you create it. With the European Union region, everything listed above (your account, team, keys, activity and audit log) is stored and processed only inside the European Union. With the Global region, it is stored in the data center closest to where the account is used, which may be outside your country. Nightly backups stay in the same region as the data they copy.
A few things are global whatever the region: security counters that stop abuse (deleted within an hour), sign-in codes (deleted within 10 minutes), messages you send through the contact form, and the public status page. Payment details are handled by Paddle under its own policy.
3. How long we keep it
- Activity, including IP addresses and user agents: 90 days, and at most the latest 10,000 requests per key.
- Usage patterns and security signals: 90 days after they were last seen.
- Audit log: one year, and at most the latest 10,000 entries.
- Messages you send us: two years.
- Sign-up and email codes: 10 minutes. Invites: 7 days or until used.
- Your plan and subscription status: until you delete your account. Paddle keeps payment records as tax law requires.
- Everything else: until you delete it or delete your account.
Deleting your account removes your data from our live systems at once. Copies remain in our nightly backups for up to 90 days, where real keys stay sealed, and are then deleted for good. Backups are used only to recover from an outage or a mistake, and we never restore an account you deleted.
4. Why we use it
Only to run Vallkey: to forward your requests, enforce your rules, show you activity, send the security alerts and sign-in codes you ask for, and stop abuse. We do not sell your data, show ads, or use analytics or tracking scripts.
5. Who else handles it
- Our infrastructure provider hosts Vallkey and stores its data, under a data processing agreement.
- Paddle.com, our reseller and merchant of record, handles payments for paid plans. When you buy a plan you give your card details, name, address and tax details to Paddle directly; we never see your card. Paddle tells us your plan, its status and your customer number. See Paddle's privacy policy.
- Our email provider delivers sign-in codes and alerts. It receives your email address and the message. Ask us for the current list of providers at any time.
- The providers you choose (for example Stripe or OpenAI) receive the requests your app sends through Vallkey, as they would without it.
- Your alert webhook, if you set one, receives alert messages.
- GitHub tells us when a ghost key or API token is pushed to a public repository, so we can turn it off. GitHub sends us the leaked value and where it was found. We send nothing back except whether it was a real Vallkey secret.
6. Cookies
The dashboard uses one cookie, to keep you signed in. It is required for the dashboard to work and expires after 8 hours. Your light or dark theme choice is saved in your own browser. There are no other cookies.
7. Your rights
You can download all your data from Settings at any time (real keys are never included) and delete your account there too. To ask us anything about your data, or to correct it, email privacy@vallkey.com. Depending on where you live, you may also have the right to complain to your data protection authority.
8. Security
Real keys are encrypted at rest and only decrypted for the moment a request is forwarded. Sign-in uses passkeys. Looser rules, revivals and real-key replacements wait an hour and send an alert. No system is perfect: if you think something is wrong, email security@vallkey.com.
9. Changes
If we change this policy in a way that matters, we will email account owners before the change takes effect.