Privacy Policy

1. Information We Collect

Account Information

When you create or use a KeyGood account, we may process information provided through our authentication system, including:

• Email address
• Account identifier
• Authentication-related account information

KeyGood currently uses Supabase Auth for account authentication, including supported OAuth authentication.

Provider API Keys

If you connect an AI provider such as OpenAI, you provide the provider API key required to make API requests on your behalf.

KeyGood:

• Validates the submitted API key format.
• Encrypts the provider API key before storing it.
• Stores the encrypted value in our database.
• Stores limited identifying information such as the last few characters of the key.
• Does not return the stored provider API key through the normal provider management API.

Provider API keys are decrypted temporarily on the server when required to forward an API request to the configured provider.

Virtual API Keys

KeyGood allows you to create virtual API keys for use by applications, developers, or other authorized users.

We store information associated with virtual keys, including:

• Key name
• Key prefix
• Secure hash of the virtual key
• Status
• Spending limits
• Spending counters
• Allowed models
• Concurrency limits
• Expiration information
• Usage timestamps

The complete virtual API key is shown to you when it is created and is not stored in plaintext in our database.

Usage and Operational Information

To provide budget control and usage tracking, KeyGood processes and stores information such as:

• Virtual key identifier
• AI provider
• Model name
• Input token count
• Output token count
• Total token count
• Estimated or actual API cost
• Request identifier
• Request status
• Request latency
• Budget events
• Budget warnings and budget-exceeded events
• Key status events
• Model access events
• Concurrency-limit events
• Relevant timestamps

This information is used to operate the service and enforce spending controls.

2. API Request and Response Content

KeyGood operates as an API proxy. As a result, API requests and responses must temporarily pass through KeyGood's servers.

Depending on the request, KeyGood may temporarily process:

• Request parameters
• Prompt or message content
• Model parameters
• Streaming data
• API response data

This processing is necessary to forward requests, enforce model and budget policies, and calculate usage.

KeyGood's current V1 implementation does not intentionally store prompt content or model response content in its application database or structured operational logs.

Usage records store usage and billing-related metadata rather than the underlying prompt or response content.

You should nevertheless avoid sending highly sensitive information through any third-party API infrastructure unless you are comfortable with the applicable provider and infrastructure arrangements.

3. How We Use Information

We use information to:

• Provide and operate KeyGood.
• Authenticate accounts and virtual API keys.
• Securely connect to configured AI providers.
• Enforce spending limits.
• Enforce model allowlists.
• Enforce concurrency limits.
• Calculate and record API usage and costs.
• Detect budget-limit events.
• Send budget warning and budget-exceeded notifications.
• Maintain service security and reliability.
• Diagnose operational errors.
• Prevent abuse or unauthorized use.
• Respond to support requests.
• Comply with applicable legal obligations.

We do not use prompt or model-response content as a separate product dataset or advertising dataset.

4. Budget Notifications

KeyGood may send automated email notifications when a virtual API key reaches configured spending thresholds.

For example, KeyGood may send an email when a daily budget reaches approximately 80% or when a budget is exceeded.

These emails may contain:

• Your account email address
• Virtual key identifier
• Current usage amount
• Configured daily limit
• Budget warning or exceeded status

Budget notification emails do not intentionally include your API prompts or model responses.

5. Service Providers and Third Parties

KeyGood relies on third-party infrastructure and service providers to operate the service.

Depending on how you use KeyGood, information may be processed by:

Supabase

Supabase provides database and authentication infrastructure used by KeyGood.

OpenAI or Other Configured AI Providers

When you configure an AI provider, KeyGood forwards API requests to that provider using the provider API key you supplied.

The provider may process the request and response according to its own terms and privacy policies.

Resend

KeyGood may use Resend to send transactional budget notification emails.

Hosting and Infrastructure Providers

KeyGood may use third-party hosting and infrastructure providers to operate its application and servers. Operational logs and technical information may therefore be processed by those providers as part of normal service operation.

We do not sell your API prompts, model responses, provider API keys, or account information as a product.

6. API Key Security

KeyGood uses technical measures intended to protect provider and virtual API keys.

Provider API keys are encrypted using authenticated encryption before database storage.

Virtual API keys are generated using cryptographically secure random data and stored as cryptographic hashes rather than plaintext.

However, no internet service or storage system can guarantee absolute security. You are responsible for protecting credentials used with your account and for promptly disabling or rotating credentials that you believe may have been compromised.

7. Data Access

Access to sensitive provider credentials and service-management operations is performed through server-side application logic.

KeyGood's data access controls are designed to prevent users from accessing other users' account and configuration records.

Operational data is used only as necessary to provide the service and maintain the platform.

8. Data Retention

We retain account, configuration, security, and usage information for as long as reasonably necessary to operate KeyGood, enforce budgets and security controls, provide support, resolve disputes, maintain service integrity, and comply with applicable obligations.

Retention periods may vary depending on the type of information and the operational or legal purpose for which it is retained.

KeyGood may introduce more specific automated retention and deletion periods as the service evolves.

9. Account and Data Deletion

You may contact KeyGood to request deletion of your account and associated personal information.

Certain information may need to be retained where reasonably necessary for security, fraud prevention, dispute resolution, accounting, legal compliance, or other legitimate operational purposes.

Where account records are deleted through the application's supported deletion mechanisms, associated provider, virtual-key, usage, and budget-event records may also be deleted according to the database relationships used by the service.

10. Your Privacy Rights

Depending on where you live and which privacy laws apply to you, you may have rights regarding your personal information, including rights to:

• Request access to personal information.
• Request correction of inaccurate information.
• Request deletion of personal information.
• Request information about how personal information is used or disclosed.
• Exercise other rights provided by applicable law.

To make a privacy-related request, contact the KeyGood operator using the contact method provided on the KeyGood website.

We may need to verify your identity or account ownership before completing certain requests.

11. Children's Privacy

KeyGood is intended for developers, businesses, and other users capable of entering into applicable service agreements.

KeyGood is not intended for children under the age required by applicable law.

We do not knowingly collect personal information from children in violation of applicable law.

12. International Processing

KeyGood and its service providers may process information in countries other than the country where you live.

By using KeyGood, you understand that information may be processed through the infrastructure and service providers necessary to operate the service.

13. Changes to This Privacy Policy

We may update this Privacy Policy as KeyGood evolves.

When we make material changes, we may update the "Last updated" date and provide additional notice where appropriate.

14. Contact

For privacy questions, data deletion requests, or other privacy-related matters, please contact the KeyGood operator through the contact information provided on the KeyGood website.