How we handle your API keys

1. Read-only access only

Before we store a key, we check every time that it can't write or change anything in your account. If it can, we reject it and don't keep it.

• Stripe: only restricted keys (starting with rk_live_ or rk_test_). Full-access secret keys (sk_) are rejected. We send empty update requests for records that don't exist; the key must be told “no permission” to pass.
• RevenueCat: the secret key (v2) must have no write permission. We check it the same way before storing it.
• Polar: an Organization Access Token with read scopes only. We send empty update requests for records that don't exist; the token must be told “no permission” to pass.
• Cloudflare: the API token must have only Account Analytics: Read. If it can reach zones, Workers or account settings, we reject it, and we only read your project's own domain.
• Plausible and Umami: Plausible Stats API keys are read-only by design; Umami uses a view-only share link.
• GitHub: no key needed. We read public repos only, and the repo must belong to the GitHub account you signed in with (or an organisation you're a public member of).
• JaoPor visitor counter: a snippet you add to your own site. No key involved.

2. Encrypted before storage

• Keys are encrypted with AES-256-GCM before they are saved. The decryption key is kept separately on the server only, not in the database.
• Keys are decrypted only on the server when numbers are fetched. They are never sent back to the browser and never logged. After saving, you only see the last few characters to recognise the key.
• The table that holds keys can't be read by any user or browser, including the project's owner.

3. Only totals are stored

• We store totals only, such as MRR, 30-day and all-time revenue, active subscriptions, visitor counts, and daily figures for the charts.
• We never store your customers' data, such as names, emails or card details.
• Verified numbers are public on your project page, labelled with the service that verified them.

4. When numbers update

Numbers are fetched once a day (around 3 AM Thailand time) and whenever you press “Refresh” in your dashboard.

5. Revoke at any time

• Disconnect a revenue or traffic source in your dashboard: the encrypted key, and that source's numbers and daily history, are deleted immediately.
• You can also revoke the key at the provider, for example in Stripe under Developers → API keys. The numbers then stop updating and your dashboard shows that the connection no longer works.
• Deleting a project deletes all of its keys.