Privacy Policy

The site does not receive any of the following. What the optional account and user store keep on a server is listed separately in section 3.

• Personal data without an account — if you do not create an account, no name, email or password is requested.
• API keys — never transmitted to or stored on a KeyChat server. No such server exists.
• Conversations — not stored on a server. Requests go from your browser directly to the provider API.
• Payment data — no card details are collected. The provider bills model usage to your own account.
• Analytics — no first-party visitor analytics script is included.

When you use the site, the following is stored in browser storage on your own device. The site operator cannot read it.

• Settings — provider, model, generation options, system prompt, storage mode. IndexedDB (keychat.settings.v1), with a localStorage fallback if IndexedDB is blocked.
• Conversations — title, messages, model, token usage and estimated cost. Stored in IndexedDB (keychat.conversations.v1) by default. If 'encrypt chat history' is enabled in the security lock, they are encrypted with the same passphrase and stored under keychat.conversations.v2, and the plaintext copy is deleted.
• API keys — stored only according to the mode you choose. 'Remember in this browser' uses localStorage, 'Until this tab closes' uses sessionStorage, and 'Forget on reload' keeps the key in memory only.
• Security lock (optional) — with a passphrase set, API keys are encrypted with PBKDF2-SHA256 (600,000 iterations) → AES-256-GCM and only exist in plaintext in memory while unlocked. Chat history can optionally be encrypted the same way. The passphrase is not stored, except in sessionStorage if 'remember in this tab' is enabled.
• Theme and language — localStorage (keychat.theme.v1, keychat.language.v1).

The account and the user store are optional. Only when you use them is the following stored on the site's server. API keys and conversations are still never sent.

• Account — display name, optional recovery email, a password hash or passkey public keys, hashes of sign-in sessions, and linked purchase codes (encrypted).
• Characters you publish to the user store — the whole character card (setting prompt, opening messages, lorebook and avatar image) and its tags. Anyone can view and download it, and your display name is shown as the author.
• Likes and reports — which account liked which character, and report reasons and details. Reporters are never shown to other users; only moderators see reports.
• Chat counts — stored as a number that is not linked to any account.

The site displays ads through Google AdSense. Third-party ad vendors may use cookies or similar technologies to serve them.

• Google and other third-party vendors may use cookies to serve ads based on your prior visits to this and other sites.
• You can opt out of personalised advertising in Google Ads Settings.
• How Google uses data from partner sites is described in the Google Privacy Policy and Google advertising technologies policy.
• Cookie use by ad vendors is governed by their own policies, which the site operator does not control.
• KeyChat itself sets no cookies, and chat works normally if you use an ad blocker.

The site is served as static files and has no application server. The static hosting provider may keep ordinary access logs to operate the service.

• What the host may log — IP address, browser and operating system, time of access, requested path.
• The site operator does not access those logs, does not aggregate or analyse them, and does not use them to build advertising profiles.

• In Settings you can delete all conversations, saved keys and local data yourself.
• Clearing this site's data in browser settings has the same effect.
• If you created an account you can delete it in account settings, which also deletes the server data in section 3 (including published characters, likes and reports). Without an account no personal data is kept on a server. Questions are welcome at the email below.

The site is not intended for children under 14. AI providers may require users to be 18 or older under their own terms, so check those as well.

If this policy changes, the update and its effective date will be posted on this page. Continuing to use the site after that date means you accept the updated policy.

Questions about privacy can be sent to [email protected].