PrivacyTermsLast updated April 3, 2025
sentkey is built around the idea that secrets should stay secret. Here is exactly what we collect, why, and how we handle it.
Encrypted message content. When you lock a message to a key card, we store it encrypted with AES-256-GCM. The encryption key is never sent to our servers in a readable form — we cannot read your message.
The key card code. We store the code associated with each locked message so the recipient can retrieve it.
IP addresses for rate limiting. We record IP addresses temporarily to prevent abuse (e.g. brute-forcing codes). These are stored in the database with a short sliding window and are not used for any other purpose.
File attachments. If you attach a photo, video, or PDF, it is stored encrypted in Vercel Blob Storage. It is only accessible via the unlock link and is deleted when you revoke the key.
We do not collect names, email addresses, phone numbers, or any account information. No login is required to use sentkey.
Your data is used only to deliver the service: storing the locked message until the recipient opens it, and allowing you to revoke it. We do not analyse message content, build profiles, or sell any data to third parties.
Locked messages remain in our database until the sender revokes them using their admin link, or until we delete them as part of routine maintenance. Rate-limit records expire automatically within minutes.
sentkey is hosted on Vercel and uses Neon for the database and Vercel Blob for file storage. These providers may process data as part of delivering the infrastructure. Their respective privacy policies apply to data processed on their systems.
You can delete your locked message at any time using the admin link you received when you created it. This permanently removes the message and any attached file from our systems.
For any other privacy questions, contact us at hello@sentkey.to.