Privacy Policy
Effective October 1, 2026
Last updated October 15, 2026
This policy tells you what personal data ohapi handles, why, and for how long. It also tells you what you can do about it.
1. Who we are
Obsidian Heron, 30 N Gould St Ste R, Sheridan, WY 82801 (“we”, “us”), operates the ohapi service at ohapi.dev. ohapi is a secrets manager. Teams use it to store secrets and to load them into applications, CI jobs and other services. Send questions about this policy to hello@ohapi.dev.
This policy covers the managed service that we operate. If your organization runs its own copy of ohapi (self-hosted), that organization operates the service and its own policy applies.
2. Two roles, two kinds of data
- Account data — we are the controller. Data about the people who use ohapi: name, email address, profile image, sign-in provider identifier, organization membership and role, API keys, and the audit trail of their actions. We decide how we use this data, and this policy governs it.
- Customer content — we are the processor. The secrets that an organization stores, with their keys, history and settings. The organization decides why this data exists. We process it only to provide the service to that organization.
3. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, profile image URL and Google account identifier, from Google sign-in | Create your account and sign you in. Send approval notices to admins | Performance of the contract |
| OAuth tokens that Google returns at sign-in | The sign-in library stores them with your account. ohapi does not call Google with them. | Performance of the contract |
| Organization membership, role and pending invites | Decide what you can see and do in each organization | Performance of the contract |
| Session record | Keep you signed in | Performance of the contract |
| API keys (stored as a SHA-256 hash only) | Authenticate the CLI, CI jobs and the API | Performance of the contract |
| API rate counters: the key id, the minute, and a count | Limit how many API calls one key can make in a minute | Legitimate interest in keeping the service available |
| OIDC token ids (the jti) and their expiry | Accept each GitHub Actions token once | Legitimate interest in a secure service |
| GitHub repository id and owner id on an OIDC trust, when you set them or when the first exchange stores them | Bind a trust to one repository | Performance of the contract |
| Device login codes (stored as a SHA-256 hash only) and who approved them | Connect the CLI on a machine that has no browser | Performance of the contract |
| Audit rows: who, which action, which secret key and environment, what the action was about (target type and id, and a short text written by the server), when | Audit trail for your organization; security investigation | Legitimate interest in a secure, accountable service |
| Notification channel settings: the destination (an event webhook URL, stored as written; a Slack-compatible URL or an event webhook signing secret, which the database stores encrypted), the member ids that an admin selects for email, the last delivery time, the time of the last test and the last error text. Also, for each secret, the deadline of the last rotation or expiry notice | Send the notifications that an admin configures, and send each one only one time | Performance of the contract |
| Audit sink settings: the destination URL (stored as written), the signing secret (the database stores it encrypted), the delivery cursor, the time of the last delivery and the last error text | Send the audit rows that an admin selects to the destination that the admin configures, at least one time for each row while the sink is enabled, for rows up to 7 days old | Performance of the contract |
| Support chat and support email: your messages. If you are signed in, also your account email address, name and user id | Answer your request. OHSupport receives this data (see section 7) | Performance of the contract |
| Secret values and their history (as processor) | Store them encrypted, and return or push them when a member asks | The organization’s instructions |
We do not store IP addresses in the application database. We do not sell personal data. We do not use customer content for advertising, for profiles or to train models. The website and the application load no analytics or advertising scripts.
4. Secret values
- The application encrypts each secret value with AES-256-GCM before the database stores it. We hold the encryption key on the server, so ohapi is not end-to-end encrypted.
- We do not read secret values, except when the law requires it or when you ask us to help with a problem.
- When an organization connects a destination (Netlify, Vercel, AWS Secrets Manager, GitHub Actions, or a webhook), ohapi sends that organization’s secret values to it. The organization chooses the destination, and the terms of that destination apply.
- For a connected destination, the database stores the encrypted access token or secret key and the destination identifiers (for example a Vercel project id, or a GitHub repository name and id). For Netlify and GitHub, the database also stores the names of the variables that ohapi created there. For Vercel, the mark is a comment on the variable in Vercel, and ohapi does not store the names. The database does not store the values that it sent.
- A one-time share link holds one encrypted value. The application deletes the value when the recipient views it. The link expires after at most 7 days.
The security page describes these controls in more detail.
5. Email, cookies and browser storage
ohapi sends email in two cases: to admins when a production change waits for their approval, and to the organization members that an admin selects, when the admin configures email notifications for a project. These emails name the project, environment and keys, and the member who made the change. They contain no secret values. They have no open or click tracking. If an admin configures a Slack-compatible webhook or an event webhook, ohapi sends the same information to that destination. A Slack-compatible message names the member who made the change by name or email address. An event webhook message also includes the user id, the API key id and the OIDC trust id of the person or credential that made the change. The organization chooses the destination, and the terms of that destination apply. ohapi deletes the notification settings when the project is deleted.
The application sets a session cookie when you sign in. During sign-in it also sets short-lived cookies that protect the sign-in flow. All of these cookies are strictly necessary. Your browser also keeps your theme choice and the mascot setting in local storage. This website sets no tracking cookies.
The support chat runs in a separate frame from OHSupport. The browser keeps the data of that frame apart from ohapi. Read section 7 for what the chat receives.
6. How long we keep data
| Data | Retention |
|---|---|
| Account data | For the life of the account. We delete it on request. |
| Session record | Ends 7 days after its last extension. Use extends it at most one time per day. A scheduled job deletes expired sessions. |
| Audit rows | 90 days. A scheduled job deletes older rows. |
| Pending invites | 14 days. Then a scheduled job deletes them. |
| API keys | Until you revoke them. A scheduled job deletes a key 30 days after it expires. |
| API rate counters | The key id, the minute, and a count. The daily cleanup job deletes a counter once it is more than 1 hour old. |
| OIDC token ids | The jti and the expiry of each exchanged token. The daily cleanup job deletes a row once the token has been expired for 5 minutes. |
| Device login codes | A code expires 10 minutes after the CLI requests it. A scheduled job deletes expired codes. |
| Secret values and history | Until an organization deletes the secret, its environment or its project. |
| Share links | The value is deleted at the first view. The link expires after at most 7 days. |
| Database backups | The point-in-time recovery window of our database provider. Then the provider overwrites them. |
7. Who else sees the data
We use these providers to run the service. Each one processes data only to provide its function to us.
| Provider | Function | Location |
|---|---|---|
| Netlify, Inc. | Hosting of the application, the API and this website | United States |
| Prisma Data, Inc. | Database hosting (Prisma Postgres) | United States |
| Google LLC | Sign-in (Google OAuth) | United States |
| Refresh (f5send), operated by Obsidian Heron on Amazon Web Services | Transactional email: approval notices to organization admins | United States |
Support chat and support email. OHSupport provides them. OHSupport is a product of Obsidian Heron, the same company as ohapi, so it is not a third party. When you use the chat, OHSupport receives your messages. If you are signed in to ohapi, it also receives your account email address, name and user id, so that it can link the chat to your account. The chat is never shown on pages that display secret values. It cannot read ohapi pages, because it runs in a separate frame.
OHSupport uses its own providers to process this data: Cloudflare (hosting), Refresh (email) and Anthropic (optional AI reply suggestions to our team). We do not send internal notes or the customer’s email address to Anthropic. The list of OHSupport providers is at ohsupport.app/subprocessors.
We can also disclose data when the law requires it, to protect the rights and safety of users or the public, or as part of a merger or acquisition. In that last case, this policy continues to apply to the transferred data until we change it with notice.
8. International transfers
The service runs in the United States. If you use it from outside the United States, we transfer your data to the United States and process it there.
9. Your rights
Depending on where you live, you can have the right to access, correct, delete or export your personal data. You can also have the right to restrict or object to its processing, and to complain to a supervisory authority. To use these rights for account data, write to hello@ohapi.dev. We answer within 30 days. For secret values, contact the organization that stores them. Members can export secret values with the CLI, and the audit log as a CSV file.
10. Children
The service is for businesses and developers. It is not for children under 16. We do not knowingly collect their data. If you think that a child gave us data, write to us and we will delete it.
11. Changes
We will post changes to this policy on this page and update the effective date. For a material change, we will post the new version at least 14 days before it takes effect.
12. Contact
Obsidian Heron, 30 N Gould St Ste R, Sheridan, WY 82801. hello@ohapi.dev. The laws of Wyoming, United States govern this policy.