Privacy Policy
Last updated 12 October 2026
- Your vault is end-to-end encrypted. We cannot read it.
- We store your email address and the minimum needed to run the service.
- No analytics, advertising or tracking. We do not sell data.
- You can delete your account and all its data from the extension at any time.
1. Scope
This policy covers the 7key server at this address and the 7key browser extension when it is connected to it. "We" means the operator of 7key.
2. What we cannot access
Website addresses, usernames, passwords, 2FA secrets and notes are encrypted on your device with a key derived from your master password, which never leaves your device. We store only the encrypted result and have no way to decrypt it. The same applies to the contents of share links: the key is part of the link and is never sent to us.
3. Information we process
| Information | Purpose | Kept for |
|---|---|---|
| Email address | Account name; sending sign-up codes and notices about sign-up attempts on your address | Until you delete your account |
| Encrypted vault items and encrypted vault key | Storing and syncing your vault across devices | Until you delete them or your account |
| Keyed hash of your login key | Verifying sign-ins without storing anything that decrypts your vault | Until you delete your account |
| Item count, sizes and change times; sign-in times | Sync and session management | Until you delete your account; sessions expire after 30 days |
| Share links you create | Delivering the encrypted item, enforcing expiry and view limits, letting you revoke the link | Deleted within one hour of expiring, being used up or being revoked |
| Share recipients' email addresses | Restricting a link to the people you chose. Stored only as keyed hashes; an address is used in plain form only to send the code its owner requested | Deleted with the link |
| One-time codes | Confirming an email address | Sign-up codes 15 minutes, share codes 10 minutes; stored as keyed hashes |
| Failed sign-ins per email; new accounts per network (keyed hash of the IP address) | Preventing password guessing and abuse | Up to 25 hours |
| IP address and request metadata | Delivering the service and protecting it from attacks | Not stored by us; held in our host's logs for up to 7 days |
For recovery after a failure, our host keeps up to 30 days of database history, and we may keep occasional offline exports. Both contain the same encrypted and hashed data described above.
4. Service providers
| Provider | Service | Data involved |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, network security | All data above, in encrypted or hashed form where stated; request logs |
| Resend, Inc. | Sending email | Recipient address and the email content (a code or a notice) |
These providers may process data outside your country under their own safeguards. We do not share data with anyone else and do not sell it.
5. Cookies and tracking
We use no cookies, analytics, advertising or tracking pixels, on this site or in our emails.
6. Browser extension
The extension keeps an encrypted copy of your vault on your device and holds the unlocked key in memory only. If you turn on "Autofill and passkeys on websites", it reads login forms on the pages you visit to offer and save logins; this happens on your device, and only logins you choose to save are sent to us, encrypted. Passkeys you create with 7key are stored the same way, inside your encrypted vault. The use of information received by the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
When you press "Check for exposed passwords", the extension sends the first 5 characters of each password's SHA-1 hash from your browser to Have I Been Pwned. Your passwords, their full hashes and your account are never sent, and nothing is sent unless you press it.
With "Website icons" on (the default), the extension asks the server for the logo of each saved site's domain. The server fetches it from DuckDuckGo or, if that has none, Google, from the server's own address, not yours. The server therefore sees the domain names of sites in your vault while it fetches their icons; it does not store them. Turn the option off in Settings to send none.
7. Security
Data is encrypted in transit with TLS and, for vault contents, end to end with AES-256-GCM. The design and its limits are published in the threat model. No system is perfectly secure, and your master password cannot be recovered if you lose it.
8. Your choices and rights
- Delete: Settings → Delete account removes your account, items and sessions immediately. Database history rolls over within 30 days.
- Access and portability: your vault is readable in the extension at any time. For the account data we hold, write to hello@7key.online.
- Revoke: you can revoke share links you created from the extension.
Depending on where you live, you may have further rights under laws such as the GDPR. Contact us to exercise them.
9. Children
7key is not directed at children under 16, and we do not knowingly serve them.
10. Changes
We will update the date above when this policy changes, and describe material changes in the extension's release notes.
11. Contact
Privacy questions and requests: hello@7key.online. Bug reports and feature requests go to the same address.