Privacy Policy
Last Updated: July 2026
We Don't Collect Anything
ProphetKey runs entirely on your device. Your API keys, master password, and personal data never leave your machine. We have zero access to any of it.
No Tracking, No Telemetry
No usage analytics. No crash reports. No fingerprinting. We don't know how many people use ProphetKey, and that's by design. The only exception is affiliate click attribution: when you arrive at our website via an affiliate referral link (?ref=...), we record that click (IP address, user agent, referrer, and timestamp) to pay affiliates correctly and detect affiliate fraud.
Payment Data
We do not process payment card data directly. All payments are handled by Creem.io, a third-party payment processor. Creem.io's own privacy policy governs how your payment information is handled. We only receive your email address and transaction status from Creem.io to deliver your activation code.
What We Store
If you create a paid account, we store your email address (for activation code delivery) and license status in our Cloudflare KV database, plus the affiliate referral code if you arrived through one — so the referring affiliate is credited correctly. If you arrive via an affiliate link, we also store a click record (IP address, user agent, referrer, timestamp, page path) for up to 180 days for affiliate-fraud prevention. We do not store names, addresses, phone numbers, or any other personal information.
Data Retention
License records are retained as long as your subscription is active and for 30 days after cancellation for refund processing. Subscription tracking indexes expire automatically one year after they are created. You may request deletion of all your data by contacting us at support@prophetkey.com.
Your Rights (GDPR / CCPA)
If you are located in the European Economic Area, United Kingdom, or California, you have the right to access, correct, delete, or port your personal data. To exercise any of these rights, contact us at support@prophetkey.com. We will respond within 30 days.
Encryption You Can Verify
Everything is encrypted with XChaCha20-Poly1305 and Argon2id — open algorithms you can audit yourself. No proprietary black boxes.
Cloud Sync Is Optional
If you choose to sync, the encrypted vault file is sent to your own cloud storage — WebDAV, Dropbox, or OneDrive. It's encrypted before it leaves your device. We never hold the keys, and we don't operate the cloud storage you use.
Cookies & External Services
This website uses Google Fonts (fonts.googleapis.com) for typography, which may set cookies in your browser. No analytics cookies, advertising cookies, or third-party tracking cookies are used. When you arrive via an affiliate referral link, we set a first-party 'pk_ref' cookie (expires after 30 days) that remembers which affiliate referred you so they're credited if you purchase later on the same device. The website is hosted on Cloudflare Pages.
Our Third Parties
Cloudflare (website hosting), Creem.io (payment processing), Resend (transactional email delivery for activation codes). Cloud sync uses your own WebDAV, Dropbox, or OneDrive account. No analytics providers, no ad networks, no data brokers.
Transparent Algorithms
Every algorithm we use is published as an RFC and widely audited by the security community. You don't have to trust us — the math is public.
Changes to This Policy
We may update this policy. We'll notify you through the app or email before major changes take effect.
Questions?
Reach us at support@prophetkey.com. We respond to every privacy inquiry within 30 days.