Privacy policy

Effective October 26, 2026

This policy explains what Key Robot (rotatekeys.app), run by Rajan Lakhani doing business as withMagic ("we", "us"), collects, why, and what control you have. Key Robot is designed so that we never receive or store the values of your API keys.

1. What we never collect

We do not receive or store the values of your API keys or other secrets. When you connect a service in your browser, the key is encrypted in your browser and saved directly to the GitHub Actions secrets of your own robot repository. The robot runs in your own GitHub account, and it reports back only names, dates and results. We cannot read your keys.

2. What we collect

• Account details: your email address (for sign-in) and, if you sign in with GitHub, your GitHub username.
• Robot details: the name of your robot repository, the names of the keys it manages (for example RESEND_API_KEY), which services and apps they belong to, the setup steps you completed, and the results and dates of each run.
• Sign-in and security records: one-time sign-in codes and links, session identifiers, and access tokens for connected AI tools. We store these only as one-way hashes, and they expire (codes after 10 minutes, sessions after 30 days, AI tool access after 7 days unless renewed). We also store a one-way hash of your network address to limit repeated sign-in attempts.
• Connected AI tools: if you connect an AI tool to our hosted MCP server, the name that tool gives itself and the address it returns to.
• Billing: if you buy Pro, your plan, whether it is paid monthly or yearly, its renewal date, and the customer and subscription IDs that Stripe gives us. Stripe collects your card details. We never see or store full card numbers.
• Waitlist: if you ask to hear when a plan or service is ready, your email address and anything you type about the service you need.
• Visit counts: which pages are viewed, the site that sent the visitor, and clicks on our sign-up button. We use no cookies for this. To count each visitor once per day, we turn the network address and browser type into a one-way code that changes every day, and we never keep the address itself.
• Messages: anything you send us by email.

3. Why we use it

We use this information to sign you in, show your dashboard, start your robot when you ask, send sign-in emails and the updates you asked for, prevent abuse, and improve Key Robot. We do not sell your information. We do not use it for advertising. We do not use tracking cookies or third-party analytics.

README badge. If you turn on the badge in your dashboard, anyone who knows your GitHub name can see when your keys last changed. Nothing else is shown: no key, no key name, no app name. It is off until you turn it on, and you can turn it off at any time.

4. Cookies

We use one cookie, kr_session, to keep you signed in. It is required for the service to work and is not used for tracking.

5. Who processes it for us

We use these providers to run Key Robot. Each processes data only to provide its service to us.

• Netlify hosts the website and its server functions, and keeps standard request logs.
• Neon hosts our database.
• Cloudflare provides our domain and sends our sign-in emails.
• GitHub runs your robot in your own account. We call GitHub on your behalf when you ask us to set up or start your robot. Your use of GitHub is covered by GitHub's own terms.
• Stripe processes payments for Pro and hosts the checkout and the page where you manage your plan. Stripe's privacy policy covers the payment details you give it.

6. How long we keep it

We keep account and robot details while your account is active. Expired codes, sessions and tokens stop working, and we clear them out regularly. If you ask us to delete your account, we delete your account and robot details within 30 days, except where the law requires us to keep something.

7. Your choices and rights

You can ask us to show you, correct, export or delete your information by emailing hello@rotatekeys.app. You can stop the robot at any time by deleting or disabling your robot repository in GitHub. Depending on where you live (for example California or the European Union), you may have additional rights, and we will honor them.

8. Security

We design Key Robot so that the most sensitive data, your key values, never reaches us. Codes, links, sessions and tokens are stored only as hashes. No system is perfectly secure, so please tell us at once if you suspect a problem.

9. Children

Key Robot is not for children under 16, and we do not knowingly collect their information.

10. Changes

If we change this policy, we will update the date above. If a change is significant, we will tell signed-in users by email before it takes effect.

11. Contact

Rajan Lakhani, withMagic. Email hello@rotatekeys.app.