Does Latchkey send my keys to the cloud?

No. Secrets are encrypted on your device with libsodium secretbox. The website handles accounts, billing, and licence delivery — never vault plaintext.

How is encryption implemented?

Vault entries use libsodium secretbox (XSalsa20-Poly1305). The master key prefers the OS keychain via keytar, with an Argon2id passphrase wrap as fallback.

Can an AI agent read every key?

Only names listed in that project’s .latchkey.toml can be requested. Each request still needs your approve or deny in the app or CLI.

Is there a free tier?

No. Paid plans start at Solo. There is a £2.99 one-off leak scan (one per email and device).

What is the leak scan?

An offline heuristic pass over a repo or pasted text that looks for exposed key shapes, then gives step-by-step rotation guidance. It does not upload your files.

How do MCP tools get a secret?

The Latchkey MCP server exposes a get-secret tool. Your agent requests a name; you approve or deny; the value is returned only on approve and an audit line is written.

What does the audit log contain?

Metadata only: timestamp, action, secret name, agent or process label, and decision. Secret values are never written to the audit log.

What is .latchkey.toml?

A per-project allowlist of environment variable names Latchkey may inject. Commit the file; keep values out of git.

Which platforms does the CLI support?

macOS, Windows, and Linux with Node.js 20+. Keychain backends are Keychain, Credential Manager, and Secret Service respectively.

How do licences work?

After checkout, Latchkey issues an Ed25519-signed licence token. Activate it with latchkey login. The CLI verifies the signature offline with a bundled public key.

What do you never see?

We never receive vault plaintext, master keys, or passphrase material. Servers may store account email, plan entitlements, device metadata, and audit metadata you choose to sync — not secret values.

Who do I contact for Enterprise or support?

Email Yusuf@yusuf-choudhury.com. Business plan includes priority email support within one business day.

← Latchkey

Privacy policy

This policy describes Latchkey (Yusuf Choudhury) as of the date shown on this site. We aim to be precise about what stays on your device and what our hosted services may store.

Secret values stay on your device

The Latchkey CLI stores API key values as encrypted ciphertext in your local vault file (for example ~/.latchkey/vault.enc.json). We do not receive those values in plaintext when you use the vault locally. Unlocking, listing names, and injecting secrets into child processes happen on your machine.

If you paste a secret into a web form on this site by mistake, treat it as exposed and rotate the key with your provider. Do not send real API keys in support email.

Metadata we may store

When you create an account, subscribe, or use hosted features, we may process:

Account and billing identifiers — email address, Stripe customer and subscription IDs, plan tier, and payment status in GBP.
Entitlements — which licence or add-ons (for example leak scan) are active for your email or device, without vault contents.
Support and transactional email — messages you send us and messages we send about your order or account.
Local audit metadata — the CLI can record secret names, actions, and timestamps in a local audit log. That log does not include secret values. We do not upload your local audit log unless you explicitly share it with us.
Standard web logs — IP address, user agent, and request paths for pages and API routes on this site, retained for security and debugging for a limited period.

Processors

We use third-party services to run the site and billing:

Stripe — payment processing and subscription lifecycle.
Supabase — storage for entitlement and subscription records tied to your account.
Brevo — transactional email (for example checkout receipts, licence delivery, or support replies you opt into).

Each processor operates under its own privacy terms. We configure them to handle only what is needed to deliver the service you purchased.

What we do not do by default

Upload your vault file or decrypted secrets to our servers.
Sell personal data to data brokers.
Use your local CLI activity for advertising profiles.

Retention and your rights

Billing records are kept as long as required for tax and fraud prevention. You may request access, correction, or deletion of personal data we hold by emailing Yusuf@yusuf-choudhury.com. Some records (for example invoices) may need to be retained after account closure where UK law requires it.

Changes

We will update this page when our practices change. Material changes will be reflected here with a revised effective date in the changelog when appropriate.

Contact

Data protection enquiries: Yusuf@yusuf-choudhury.com (Yusuf Choudhury, UK).

Secret values stay on your device

If you paste a secret into a web form on this site by mistake, treat it as exposed and rotate the key with your provider. Do not send real API keys in support email.

Metadata we may store

When you create an account, subscribe, or use hosted features, we may process:

Account and billing identifiers — email address, Stripe customer and subscription IDs, plan tier, and payment status in GBP.

Entitlements — which licence or add-ons (for example leak scan) are active for your email or device, without vault contents.

Support and transactional email — messages you send us and messages we send about your order or account.

Local audit metadata — the CLI can record secret names, actions, and timestamps in a local audit log. That log does not include secret values. We do not upload your local audit log unless you explicitly share it with us.

Standard web logs — IP address, user agent, and request paths for pages and API routes on this site, retained for security and debugging for a limited period.

Processors

We use third-party services to run the site and billing:

Stripe — payment processing and subscription lifecycle.

Supabase — storage for entitlement and subscription records tied to your account.

Brevo — transactional email (for example checkout receipts, licence delivery, or support replies you opt into).

Each processor operates under its own privacy terms. We configure them to handle only what is needed to deliver the service you purchased.