Privacy Policy
Effective Date: February 8, 2026
1. Introduction
APIKeyConnect ("we," "us," or "our") operates the website at https://apikeyconnect.com and the APIKeyConnect Chrome browser extension (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.
2. Data Controller
For the purposes of applicable data protection laws (including the GDPR), the data controller is:
APIKeyConnect
Email: apikeyconnect@gmail.com
Website: https://apikeyconnect.com
3. Information We Collect
3.1 Information You Provide Directly
| Data Category | Examples | Purpose |
|---|---|---|
| Account Information | Email address, display name, profile photo (via Google or GitHub OAuth) | Account creation, authentication, and communication |
| API Keys & Credentials | Third-party API keys you store in the extension | Core service functionality — secure storage and retrieval of your API keys |
| Team & Organization Data | Team names, member email addresses, roles, invitation details | Team management features |
| Project Data | Project names, associated API key references | Organizing your API keys by project |
| Payment Information | Subscription plan selection (card details are processed by Stripe and never touch our servers) | Processing subscription payments |
3.2 Information Collected Automatically
| Data Category | Examples | Purpose |
|---|---|---|
| Device Identifier | A randomly generated device ID assigned to each Chrome extension installation | Managing extension sessions per device |
| Authentication Tokens | JWT access and refresh tokens (refresh tokens stored as SHA-256 hashes only) | Authenticating extension requests securely |
| Server Logs | Timestamps, request types, error codes (no IP addresses, no browsing history) | Debugging, security monitoring, and service reliability |
| Usage Statistics | Number of projects, number of stored API keys | Enforcing plan limits and displaying account stats |
3.3 Information We Do NOT Collect
We want to be explicit about what we do not collect:
- Web browsing history or activity — The extension does not monitor, track, or record the websites you visit.
- Page content or form data — The extension does not read, scrape, or intercept content from the web pages you visit.
- Cookies from other websites — We do not access or track cookies from any other origin.
- Location data — We do not collect geolocation information.
- Health, financial, or biometric data — We do not collect any such sensitive data.
- Personal communications — We do not read your emails, messages, or other communications.
- Analytics or telemetry — We do not use Google Analytics, tracking pixels, or any third-party analytics service.
4. How We Use Your Information
We use the collected information exclusively to:
- Provide the Service — Securely store, manage, and retrieve your API keys across devices via the Chrome extension and web dashboard.
- Authenticate your identity — Verify your account via Firebase Authentication (email/password, Google, or GitHub OAuth) and issue secure JWT tokens for the extension.
- Process payments — Manage your subscription plan via Stripe (we never see or store your card details).
- Manage teams — Facilitate team invitations, member roles, and shared access as directed by you.
- Send transactional emails — Notify you of team invitations, invitation acceptances, and payment-related actions. We do not send marketing emails.
- Ensure security — Detect and prevent unauthorized access, abuse, and fraud.
- Improve the Service — Diagnose technical issues and improve reliability using aggregated, anonymized data only.
5. Chrome Web Store Limited Use Disclosure
Specifically, we affirm that:
- We only use data obtained through the Chrome extension to provide and improve the single, stated purpose of the extension: secure API key management.
- We do not sell user data to third parties, advertising platforms, data brokers, or information resellers.
- We do not use or transfer user data for serving advertisements, including retargeting or personalized advertising.
- We do not use or transfer user data to determine creditworthiness or for lending purposes.
- Human access to user data is limited to debugging with user consent, aggregated anonymized analysis, security investigations, and legal compliance.
6. How We Share Your Information
We do not sell, rent, or trade your personal information. We share data only with the following service providers, strictly as necessary to operate the Service:
| Service Provider | Data Shared | Purpose | Privacy Policy |
|---|---|---|---|
| Google Firebase (Authentication, Firestore, Cloud Functions, Hosting) | Account data, API key metadata, team data, extension session data | Core infrastructure — authentication, database, and serverless compute | Firebase Privacy |
| Stripe | Email, display name, subscription plan selection | Payment processing (Stripe handles all card details directly — we never see them) | Stripe Privacy |
| Google Gmail SMTP | Recipient email addresses, email content | Sending transactional emails (team invitations, payment notifications) | Google Privacy |
We may also disclose your information if required to:
- Comply with applicable laws, regulations, or legal processes.
- Protect the rights, property, or safety of APIKeyConnect, our users, or the public.
- Enforce our Terms of Service.
In the event of a merger, acquisition, or sale of assets, user data may be transferred to the successor entity. We will notify affected users via email or prominent notice on our website before such a transfer and before any change to this Privacy Policy.
7. Data Security
We implement the following security measures to protect your data:
- Encryption in transit — All data transmitted between your browser, the extension, and our servers uses HTTPS/TLS encryption.
- Encryption at rest — Data stored in Google Firebase is encrypted at rest using Google-managed encryption keys (AES-256).
- Token security — Extension refresh tokens are stored as SHA-256 hashes. Plaintext tokens are never persisted on our servers.
- Session management — Extension sessions expire after 30 days and can be revoked at any time by the user.
- Webhook integrity — Stripe webhook payloads are verified using signature validation to prevent tampering.
- Least privilege — The Chrome extension requests only the minimum permissions necessary to function.
While we take commercially reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
8. Data Retention
| Data Category | Retention Period |
|---|---|
| Account data (email, display name, profile) | Until you delete your account |
| API keys and project data | Until you delete them or delete your account |
| Team and invitation data | Until the team is dissolved or you leave the team |
| Extension session tokens | 30 days from issuance, or until revoked |
| Subscription and payment metadata | As required by applicable tax and financial regulations (typically 7 years) |
| Server logs | 30 days (automatically purged by Google Cloud Functions) |
When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.
9. Cookies and Local Storage
APIKeyConnect uses only essential cookies and local storage required for the Service to function. We do not use tracking cookies, advertising cookies, or analytics cookies.
| Technology | Purpose | Duration |
|---|---|---|
| Firebase Auth session | Maintaining your login session on the web app | Session / persistent (managed by Firebase SDK) |
| Chrome extension storage | Storing your extension authentication tokens locally on your device | Until you log out or revoke the session |
10. Your Privacy Rights
10.1 Rights for All Users
Regardless of your location, you have the right to:
- Access — Request a copy of the personal data we hold about you.
- Correction — Request correction of inaccurate or incomplete data.
- Deletion — Request deletion of your account and personal data.
- Data Portability — Request your data in a structured, machine-readable format.
- Revoke Extension Access — Revoke your Chrome extension session at any time from your profile settings.
10.2 Additional Rights for EU/EEA Residents (GDPR)
If you are located in the European Economic Area, you also have the right to:
- Restrict processing — Request that we limit the processing of your personal data.
- Object to processing — Object to our processing of your personal data based on legitimate interests.
- Withdraw consent — Where processing is based on consent, withdraw your consent at any time without affecting prior processing.
- Lodge a complaint — File a complaint with your local data protection supervisory authority.
Legal basis for processing: We process your data based on (a) performance of a contract (providing the Service you signed up for), (b) your consent (e.g., OAuth sign-in), and (c) legitimate interests (security monitoring, service improvement).
10.3 Additional Rights for California Residents (CCPA/CPRA)
If you are a California resident, you have the right to:
- Know — Request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months.
- Delete — Request deletion of your personal information, subject to certain exceptions.
- Opt-out of sale or sharing — We do not sell or share your personal information for cross-context behavioral advertising. No opt-out is necessary.
- Non-discrimination — We will not discriminate against you for exercising any of your privacy rights.
Categories of personal information collected in the preceding 12 months: Identifiers (email, display name), commercial information (subscription plan), and internet activity (server logs). We collect this information directly from you and from authentication providers (Google, GitHub).
10.4 How to Exercise Your Rights
To exercise any of the above rights, contact us at apikeyconnect@gmail.com. We will respond to your request within 30 days (or sooner where required by law). We may ask you to verify your identity before processing your request.
11. International Data Transfers
Our Service is hosted on Google Cloud Platform (Firebase) with servers primarily located in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States.
For users in the EU/EEA, Google provides data processing terms that include Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection for international transfers. Stripe similarly processes payment data under SCCs and has certified under applicable data transfer frameworks.
12. Children's Privacy
The Service is not directed to individuals under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child, we will delete that information promptly. If you believe a child has provided us with personal data, please contact us at apikeyconnect@gmail.com.
13. "Do Not Sell or Share My Personal Information"
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. Because we do not engage in these practices, no opt-out mechanism is required; however, if you have any concerns, please contact us at apikeyconnect@gmail.com.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the "Effective Date" at the top of this page.
- Post a notice on our website or send an email notification for significant changes.
We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Email: apikeyconnect@gmail.com
- Website: https://apikeyconnect.com
We aim to respond to all privacy-related inquiries within 30 days.