Privacy Policy

Information you give us

Information we generate

We do not collect the plaintext of your secrets. Secret material is encrypted before storage, decrypted only in memory to serve an authorized request, and deliberately excluded from logs, error reports, and analytics.

• We do not sell or rent personal information, and we never have.
• We do not share personal information with advertising networks or data brokers.
• We do not use Customer Data to train machine-learning models.
• We do not run third-party advertising or cross-site tracking pixels on our site.
• We do not read the contents of your secrets, and our support staff cannot decrypt them.

Where the GDPR or UK GDPR applies, we rely on the following bases:

We share personal information only with the sub-processors needed to run the Service, each bound by a written contract that limits them to our instructions. The current list, with the purpose and data category for each, is published on our sub-processors page and forms part of our commitments to you.

We also share information where the law requires it, where it is necessary to establish or defend a legal claim, and in a merger or acquisition - in which case we will give notice before your information becomes subject to a different privacy policy.

We will push back on overbroad government requests, require valid legal process, and notify affected customers unless a legally binding order prohibits it.

We operate infrastructure in the United States and the European Union. Where personal information moves out of the EEA, the UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses together with the UK Addendum, and we assess the destination country’s laws before transferring.

Enterprise customers may request that their Workspace be pinned to a specific region. Contact us before onboarding if this is a requirement for you.

• Secret material is envelope-encrypted with AES-256-GCM: a per-secret data key, wrapped by a per-organization master key.
• All traffic is encrypted in transit with TLS 1.2 or better; data at rest is encrypted at the storage layer as well.
• Access to production is limited to a small number of engineers, requires multi-factor authentication, and is itself logged.
• Credentials issued to clients are short-lived by design, so the value of an intercepted credential decays within minutes.
• Passwords are hashed with a memory-hard algorithm; passkeys and TOTP two-factor authentication are supported and recommended.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant supervisory authority as required by law, and without undue delay.

Depending on where you live, you may have the right to access a copy of your personal information, to correct it, to delete it, to restrict or object to processing, to portability, and to withdraw consent. You also have the right to complain to your local supervisory authority.

California residents additionally have the right to know what is collected, to delete, to correct, to opt out of sale or sharing - we do neither - and not to be discriminated against for exercising these rights.

To exercise a right, email privacy@shortspan.dev from the address on your account. We respond within thirty (30) days and will not charge you for a first request. Account settings also let you export and delete your own data directly.

If your personal information sits inside another organization’s Workspace, we are the processor and must refer your request to them. We will tell you who to contact and will assist them in responding.

We use a small number of strictly necessary cookies for sessions, CSRF protection, and remembering your light or dark theme. We do not use advertising cookies or cross-site trackers. Full detail is in our Cookie Policy.

On our public pages - the website, documentation, legal pages, status page, and sign-in and sign-up screens - we run our own first-party, cookieless analytics to understand which pages are read and how visitors find us. It runs on our own servers and shares nothing with any third party. It stores nothing on your device. To count visits without identifying you, we combine your IP address and browser user agent with a random value that changes every day and is then destroyed, and keep only the resulting one-way hash; the IP address itself is never stored. We record the page viewed, the referring site, campaign tags in the link, approximate location to city level (as reported by our network provider), browser, operating system, device type, screen size, language, time spent and scroll depth on the page, page-load performance, and clicks on marked links and buttons. When an account is created we record that a signup happened, without linking it to the account.

Because the daily value is destroyed, we cannot recognise you from one day to the next, and we cannot connect this data to you or to your account. We honour Global Privacy Control and Do Not Track: if your browser sends either, nothing is recorded. Analytics records are deleted after thirteen months. Our legal basis is our legitimate interest in understanding and improving our website.

We will post any change here and update the “last updated” date. For material changes we will notify account holders by email at least thirty (30) days before the change takes effect.

Privacy enquiries: privacy@shortspan.dev. Data protection contact: dpo@shortspan.dev.

Shortspan Technologies, -.