Privacy Policy

This Privacy Policy explains what information CYPHR collects, how it is used, and how it is stored when you use the service.

Information Stored

Authentication Information

CYPHR currently uses GitHub OAuth through Supabase Auth for authentication. When you sign in, GitHub provides your name, email address, and profile picture. Supabase also maintains information associated with your account, including your account creation time, last sign-in time, and authentication provider.

CYPHR Account Information

CYPHR maintains a user profile associated with your Supabase account. This profile currently stores your user ID and email address.

API Keys

When you add an API key to CYPHR, the server receives the key and extracts its last four characters to create a key hint. The full API key is then encrypted using AES-256-GCM before being stored.

An API key record contains the associated user ID, key ID, key name, encrypted key, key hint, service name, and creation timestamp.

How API Keys Are Handled

CYPHR does not store plaintext API keys in its database. When you request an API key, the server retrieves the encrypted value, decrypts it in memory, and returns the plaintext key to your client.

Responses containing API keys are sent with the Cache-Control: no-store directive. The client immediately copies the returned key to your clipboard. CYPHR does not log or otherwise persist the plaintext API key.

Temporary Caching

CYPHR uses Cloudflare KV for temporary caching. User API key data may be cached for up to 24 hours (86,400 seconds). This cached data contains the encrypted API key records, never plaintext API keys.

CYPHR also temporarily caches the JWKS used to verify authentication tokens. JWKS data is cached for up to 10 minutes (600 seconds) in Cloudflare KV and may also be temporarily held in Cloudflare Worker memory.

Third-Party Services

CYPHR uses third-party infrastructure to provide and operate the service. These services currently include:

• Supabase for authentication and GitHub OAuth.
• Neon for PostgreSQL database hosting.
• Cloudflare Pages for client side hosting.
• Cloudflare Workers for server side hosting and API processing.
• Cloudflare KV for temporary caching.
• Cloudflare Web Analytics for website analytics.

Account Deletion

CYPHR does not use soft deletion for user accounts. When an account deletion request is made, CYPHR first requests deletion of the associated account from Supabase Auth.

If the Supabase deletion succeeds, CYPHR deletes the corresponding user record from its database. Associated API key records are deleted through the database's cascading deletion rules. CYPHR also initiates deletion of any cached API key data associated with the account.

Data Security

CYPHR is designed to minimize exposure of stored API keys. API keys are encrypted using AES-256-GCM before being persisted, and plaintext API keys are not stored in Cloudflare KV. CYPHR does not yet support full End-to-End Encryption, API keys are decrypted server-side only on demand and are never stored, logged, or cached.

CYPHR is open source, allowing its implementation to be inspected publicly.

Questions and Concerns

If you have any questions or concerns about this Privacy Policy or any issue regarding CYPHR, please raise an issue in the CYPHR repository.

Please do not include API keys, credentials, or other sensitive information in public issues.

Changes to This Policy

This Privacy Policy may be updated as CYPHR's features, infrastructure, or data practices change. Any changes will be reflected on this page along with an updated revision date.