Privacy & data security

The short version

• We never sell or share your personal data with third parties for marketing or any other purpose.
• We do not collect or store credit card, debit card, or any other payment details anywhere in the product.
• The secrets you send and receive are encrypted in your browser before they reach our servers, and stored as ciphertext - but our infrastructure holds the keys needed to decrypt them when your organization requests to view or save one. This is not a zero-knowledge design.

What we collect

To run an account, we store:

• Your name, email address, and organization details you provide at signup or when invited.
• Optional profile information you choose to add (title, phone number, address).
• Metadata about credential-share requests: timestamps, status, and who created or viewed them - never the secret content itself.
• Standard technical data needed to operate the service (e.g. a hashed record of the IP address a secret was submitted from, used only for abuse prevention).

How secret encryption works

Every secret (API key, password, or other credential) is encrypted inside your browser using your organization's key pair before it is sent to us, so it is stored as ciphertext, never plaintext. The private key needed to decrypt it is also encrypted at rest, using a key our servers hold. That means GoSecretly's infrastructure - and, in the event of a server or database compromise, an attacker with access to it - is capable of decrypting stored secrets. We do not build a zero-knowledge system for this product; we rely on standard security practices instead (encryption at rest and in transit, mandatory two-factor authentication, strict access controls, and audit logging of every access).

Payment and card data

We do not collect, process, or store credit card numbers, debit card numbers, or any other payment card information anywhere in this product.

Cookies

We use one strictly necessary cookie to keep you signed in (your session cookie). We do not use advertising, tracking, or third-party analytics cookies.

How your password and secrets are protected

• Login passwords are hashed (never stored in plain text) before being saved.
• Two-factor authentication is mandatory for every account.
• Secret content is encrypted client-side before it reaches us, as described above, and permanently deleted from our database once viewed and confirmed (unless you choose to save it to your organization's vault).
• All traffic to and from the service is encrypted in transit (TLS).

Who we share data with

We do not sell, rent, or share your personal data with third parties. Metadata may be processed by infrastructure providers strictly necessary to run the service (e.g. our hosting and email-delivery providers), solely to operate the product - never for their own purposes.

Questions

If you have any questions about this policy or how your data is handled, contact us.