Privacy Policy

Last Updated: April 13, 2026

1. What We Collect

We NEVER collect: Your API keys (they are encrypted client-side before reaching our servers), your master passphrase (never transmitted), or your decrypted secrets.

We collect: Email address (for account creation and waitlist), OAuth profile information (name, avatar), usage analytics (what endpoints you call, not what keys you store), and audit logs (actions taken, timestamps).

2. How We Use Your Data

Your email is used to authenticate you and send important service updates. Encrypted API keys are stored in our D1 database solely to enable the proxy functionality. Audit logs are used for security monitoring and troubleshooting.

3. Data Storage

All data is stored on Cloudflare's global network. Encrypted API keys are stored in D1 databases. Audit logs are stored in D1. Rate limiting data is stored in KV. No plaintext secrets are ever written to disk.

4. Data Retention

We retain your encrypted keys until you delete them or use the Panic Stop feature. Audit logs are retained for 90 days. You may request deletion of your data by contacting us.

5. Third-Party Services

We use Cloudflare (hosting, D1, KV), Google OAuth (authentication), and GitHub OAuth (authentication). These services have their own privacy policies. We do not sell your data to third parties.

6. Your Rights

You have the right to access, correct, or delete your personal data. You may export your encrypted keys at any time. To exercise these rights, contact us at privacy@phantom-projects.com.

7. Security

While we implement industry-standard security measures, no system is 100% secure. You use Ephos at your own risk. We are not liable for any data breaches or unauthorized access.

8. Children's Privacy

Ephos is not intended for children under 13. We do not knowingly collect personal information from children under 13.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after changes constitutes acceptance of the new policy.

10. Contact

For privacy questions, email: privacy@phantom-projects.com