Privacy Policy

• Your account. Email address, an optional display name, and either a hashed password or a link to your GitHub account. Passwords are stored only as a bcrypt hash — the original is never written down and cannot be recovered from it.
• What you save. Your items, collections, tags, custom item types and editor preferences. This is the content of the product; it is stored so it can be shown back to you.
• Files you upload. Kept under a prefix belonging to your account in a private bucket. No file has a public address; access is granted through short-lived links issued only after your session has been checked.

There is no analytics, no advertising, no tracking pixels and no third-party scripts. The only cookies set are the ones needed to sign you in and keep you signed in. Nothing is sold, rented or shared for anyone else’s marketing.

Each receives only what its job requires:

• Vercel hosts the app; Neon is the PostgreSQL database; Cloudflare R2 stores uploaded files.
• OpenAI powers the optional AI features; Resend sends account email; Upstash holds short-lived counters used to rate limit abusive traffic.
• Stripe handles the subscription flow, in test mode — see below. GitHub is involved only if you choose to sign in with it, in which case SlyKeep receives your GitHub email and profile name.

When — and only when — you press one of the AI buttons, the title and content of that single item are sent to OpenAI so a model can suggest tags, a description, an explanation or an improved prompt. Nothing is sent in the background, nothing is sent when you save an item, and the result is written into the item only if you accept it.

OpenAI does not use data sent through its API to train its models. It may keep a request for up to 30 days to monitor for abuse, after which it is deleted.

SlyKeep is a portfolio project and Stripe is configured in test mode. No real payment is processed and no card is ever charged. Card details are entered on Stripe’s own pages and never reach SlyKeep either way; what is stored is a customer reference, a subscription reference, the selected price and the period end, so the app can show which plan an account is on.

Your data is kept while your account exists. Deleting your account, from the Settings page, removes your account record and every item, collection and tag attached to it, and deletes your uploaded files from storage. It is immediate and cannot be undone. Accounts created but never confirmed are deleted automatically by a nightly job.

Records may persist briefly in routine backups and in the server logs kept by the services above, on their own retention schedules, before they expire.

Everything SlyKeep holds about you is visible in the application: you can read, edit and delete any of it at any time, and delete the whole account in one action. Depending on where you live you may also have statutory rights to access, correct, export or restrict processing — to exercise any of them, use the contact address below.

If what SlyKeep does with data changes, this page changes with it and the date at the top is updated. Where practical, significant changes affecting existing accounts are also announced by email. SlyKeep is not directed at children under 13.

SlyKeep is operated as an independent portfolio project, not by a registered company. For privacy questions or data requests, write to privacy@slykeep.com.