Legal
Privacy Policy
Last updated 16 July 2026
The short version
Right now Rekey is a waitlist for a product in development. The only personal data we hold is the email you give us, plus website analytics via Google Analytics, which sets cookies and only runs if you accept them. We don't sell your data, we don't run advertising networks, and your passwords stay encrypted on your device, and if you use sync, the only copy we ever hold is ciphertext we can't read.
This policy explains what Rekey ("we", "us") collects through getrekey.com, why, and your rights over it. It reflects our current stage: an email waitlist for a browser extension that is still being built. We'll update it, and tell you, before we ever handle real passwords.
What we collect
Information you give us
- Your email address, when you join the waitlist.
- An optional survey answer (the "would you install this?" dropdown), if you choose one. It helps us understand interest; it's not tied to your identity beyond your email.
Information collected automatically
- Website analytics via Google Analytics (GA4). With your consent, Google sets cookies to measure page views, referrers, and general usage so we can improve the site. You choose whether to allow this the first time you visit (see Cookies below); if you decline, these cookies are not set.
- Basic server logs from our host (Netlify), such as IP address and request data, kept briefly for security and to keep the site running. This is standard for any website.
Cookies
The only cookies Rekey's website uses are Google Analytics measurement cookies (such as _ga), and only if you accept them. On your first visit you'll see a short banner where you can Accept or Decline analytics cookies. If you decline, Google Analytics is not loaded and no analytics cookies are set. You can change your mind any time by clearing your browser's site data for getrekey.com. We do not use advertising, cross-site tracking, or ad-targeting cookies of any kind.
What we do not collect
- No readable passwords. Your passwords are encrypted on your device with a master password only you know. Sync across devices is optional and zero-knowledge: our server only ever stores encrypted ciphertext it cannot read, so even we can't see your passwords.
- No advertising or ad-targeting networks, and no cross-site tracking. The only cookies are Google Analytics measurement cookies, set only if you accept them.
- We never sell or rent your data to anyone.
Why we use it, and our legal basis
We use your email to tell you about early access and launch, and to send occasional product updates. We use Google Analytics to understand and improve the site. Where the GDPR applies, our legal basis for the waitlist email and for analytics cookies is your consent (which you can withdraw at any time), alongside our legitimate interest in running and securing the site.
Who we share it with
We use a small number of trusted providers who process data on our behalf, only to deliver the service:
- Formspree, receives and stores waitlist form submissions (and emails us each new signup).
- Brevo, the email tool we use to send launch and update emails.
- Netlify, hosts the website.
- Google (Google Analytics), measures website traffic; only active with your consent, and may process data on servers in the US.
That's the full list. We may add processors as we grow and will update this page when we do.
How we protect it
The site is served over HTTPS. We keep the data we collect to a minimum, limit who can access it, and rely on providers that maintain their own security standards. Minimising what we hold is our first line of defence, the less we collect, the less there is to lose.
Your rights
Wherever you live, you can:
- Unsubscribe at any time using the link in any email we send.
- Access the data we hold about you, or ask us to correct or delete it.
- Withdraw consent and ask for your data in a portable format.
To exercise any of these, contact us through getrekey.com. Depending on where you live, you may also have rights under the GDPR (EU/UK) or CCPA/CPRA (California); we honour these regardless of location.
How long we keep it
We keep your waitlist email until launch and a reasonable period after, or until you unsubscribe or ask us to delete it, whichever comes first. Google Analytics data is retained under Google's default retention settings and is used only in aggregate to understand site traffic.
Children
Rekey isn't directed at children under 16, and we don't knowingly collect their data. If you believe a child has given us their information, contact us through the site and we'll remove it.
When the product ships
Rekey stores passwords encrypted on your own device (or works alongside the manager you already use), with zero-knowledge design, no telemetry, and open-source code. Optional cross-device sync stores only encrypted ciphertext on our server, a copy that's useless to anyone, including us, without your master password. To check whether a password has appeared in a known breach, Rekey uses the Have I Been Pwned range API with k-anonymity: only the first five characters of a hash ever leave your device, never a password. We'll keep the specifics here current as the product evolves.
Changes to this policy
If we change this policy, we'll update the date above and, for material changes, notify waitlist members by email.
Contact
Questions about privacy? Reach us through getrekey.com. Rekey is operated by GetRekey.
This policy is written for Rekey's current waitlist stage and will be expanded with product-specific and jurisdiction-specific detail, reviewed by a legal professional, before launch.