Privacy policy

• Your account: your email address and name, and how you signed in (email link, Google or GitHub).
• Your projects: the web addresses you add and the results of each scan. If a scan finds a secret key, we store where it is and what kind it is, never the key itself.
• Audit work: your notes, your engineer’s findings, estimates, your approvals and the time logged on fixes.
• An activity log of important actions, such as matches, approvals and sign-ins, so everyone can see who did what and when.
• If you apply as an engineer: the details in your application, such as your public work history, the tools you know and your rate.

Only to run OpenKeel: to scan your app, match you with an engineer, keep a record of the work and its approvals, send you updates about it, and keep the service secure.

We host OpenKeel on Cloudflare, which stores our data and sends our emails on our behalf. If you sign in with Google or GitHub, they confirm who you are; we only receive your name and email address.

The engineer matched to your project sees that project’s details and audit work, and nothing else. Engineers sign an NDA before seeing any client app.

• We never sell your data or share it for advertising.
• We never ask for your passwords by chat or email.
• We don’t use advertising or tracking cookies. The cookies we set keep you signed in and protect forms.

You can delete your account from Settings. That removes your account and your projects. We may keep the activity log and billing records for as long as the law requires, and no longer.

You can ask to see, correct or delete what we hold about you. Write to hello@openkeel.dev. If we change this policy in a way that matters, we’ll update the date above and tell signed-in users.