KeyRotate privacy policy

Effective 2 November 2026

KeyRotate is an API key manager for Mac and Windows, published by Enfour, Inc. This policy explains what it stores, what leaves your computer and what Enfour receives. Everything below describes the Mac edition; the section KeyRotate for Windows says where the Windows edition differs.

What Enfour collects

Nothing. KeyRotate does not create an Enfour account, has no sign-in, and sends Enfour no analytics, usage statistics, crash reports or advertising identifiers. Enfour does not receive your keys, the names of the services you use, your spending figures or any record that you ran the app.

Where your keys are kept

Every key value is stored in the macOS Keychain as an item belonging to KeyRotate alone. Key names, labels, tags, accounts, plan costs, usage readings and settings are stored in the app's own container on your Mac. Nothing is stored on a server operated by Enfour.

The vault unlocks with Touch ID once per session and re-locks when KeyRotate goes to the background. Copying a key marks the clipboard as concealed and clears it after 30 seconds, unless you have copied something else in the meantime.

What leaves your Mac

KeyRotate contacts a service provider only when you ask it to verify, rotate, or read the usage and billing figures for a key you have stored. Those requests go directly from your Mac to that provider, carrying the credential the operation needs. Each provider applies its own privacy policy. There is no intermediary server, and Enfour is not a party to those requests.

If you turn on Usage Watch, KeyRotate also reads, every 15 minutes, the usage reports of your own Anthropic, OpenAI and OpenRouter organisations with the admin keys you stored, and the Amazon Bedrock entries of your own AWS CloudTrail history. Those readings stay in a file in KeyRotate's container on your Mac. When KeyRotate is paired with FrontierStack, it also asks FrontierStack on the same Mac how much it sent with each key; keys are identified there only by a shortened fingerprint, never by their value.

If you add remote repositories, KeyRotate contacts the git host you entered (GitHub, Gitea, Forgejo, GitLab, Bitbucket or your own server) with the token you chose from your vault, to list your repositories, download their history into KeyRotate's own storage on your Mac, and — on GitHub — read the secret-scanning alerts GitHub raised. The secrets in those alerts are compared with your stored keys on your Mac and not kept. Nothing about your keys is sent to the host.

If you add email addresses to Guard's Email addresses in breaches box and store a Have I Been Pwned API key, KeyRotate sends each address you listed, once a day, to Have I Been Pwned (haveibeenpwned.com) with that key, to learn which data breaches it appears in. Only the addresses you add are sent, and only to Have I Been Pwned, whose own privacy policy applies; the answers stay in a file in KeyRotate's container on your Mac. Remove an address and it is no longer sent and its results are deleted.

If you turn on an Apple-push alert on the Guard screen (new breach advisories, or a warning when KeyRotate stops guarding), KeyRotate registers with Enfour's push relay. The relay stores a random install identifier, a public key KeyRotate made for it, this Mac's Apple push token, your language, which alerts you chose and when KeyRotate last checked in. It never receives your keys, the names of the services or vendors you use, file names or your Mac's name. Whether an advisory concerns you is worked out on your Mac. Turn both alerts off and the push token is withdrawn.

If you pair KeyRotate for iPhone or Apple Watch, the phone and your Mac exchange what the phone shows (Guard's alarms, the names and state of your keys — never a key's value) and the rotations you ask for through Enfour's relay. Everything between them is encrypted with keys only the two devices hold; the relay stores and forwards ciphertext and the phone's push token. Removing a paired device on the Mac deletes its copy at the relay.

If you set up OpenAI safety notices, Enfour's relay also stores a random webhook address for your install, the signing secret OpenAI gave you for it (used only to check that a notice really comes from OpenAI) and, for each notice OpenAI sends, its type and case number until your Mac collects it; collected notices are kept for 30 days so a repeat is recognised. The relay pushes a fixed alert to your registered devices and keeps your push token while the feature is on. It never receives an OpenAI key or what a case says: KeyRotate reads the case from OpenAI itself, with your own key, and, if it is paired with FrontierStack, passes its findings to FrontierStack on your Mac. Turning the feature off deletes the address, the secret and any notices at the relay.

If you configure notifications to an ntfy or Gotify server, KeyRotate sends alerts to the server address you enter. All requests use HTTPS and refuse redirects. Plain HTTP is accepted only for an address on your own machine or network.

Files KeyRotate writes

KeyRotate can reach only the files and folders you have picked yourself, remembered as macOS security-scoped bookmarks. When it updates a file it matches your variable by name and rewrites that line. It does not parse, copy or retain anything else in the file, and it keeps a local backup so a change can be undone.

Two features read whole files, and only in folders you add to them. Leak Scan reads the files in a project folder, and its git history, to look for keys and other secrets. Guard's AI tool log check reads the conversation logs of the AI coding tools whose folders you link (for example Claude Code's or Codex's), about once an hour and only what was added since the last read, to see whether a key or password went into them. Both compare what they find with your stored keys on your Mac, keep where each one was found and a masked preview, never the secret itself, change nothing in the folder and send nothing anywhere.

Servers and other machines

If you add a server, KeyRotate connects over SSH to the host you specify, using credentials you supply, to read and update the files you have listed there. Those credentials are stored in the Keychain. Connections are made only to hosts you have configured.

If you pair KeyRotate with FrontierStack on the same Mac, the pairing lets KeyRotate hand a credential to FrontierStack over a local authenticated connection. This is a link between two apps on your own machine and does not reach Enfour.

Subscription

KeyRotate is sold as an auto-renewing subscription through the App Store. Apple processes payment, renewal, cancellation and refunds under its own terms. Enfour does not process your payment and does not see your payment details.

KeyRotate for Windows

On Windows, each key value is encrypted on its own with Windows’ data protection (DPAPI) for your Windows account and kept, with the rest of KeyRotate’s data, in %APPDATA%\KeyRotate on your PC. Revealing a key asks for Windows Hello. KeyRotate reads and writes the files you pick by their path. The iPhone and Apple Watch companion, Apple push alerts and the FrontierStack pairing are Mac-only, so none of what those paragraphs describe happens on Windows.

The Windows edition is bought from Enfour rather than an app store, so two things do reach Enfour:

• Your purchase. Stripe, Square or Paddle takes the payment. Enfour receives the email address, name and country you give at checkout and the payment and subscription records, and emails you the licence code. Enfour never sees your card details.
• The licence check. When you activate, and every few hours after that, KeyRotate sends Enfour’s licence server (frontierstack.app) the licence code, an anonymous identifier for your PC (a one-way hash, not your PC’s serial number or hardware ID), a public key KeyRotate made for the PC, and the PC’s name, so you can tell your PCs apart under My Licence. The server records when each PC last checked in. Nothing about your keys, vendors, files or use of the app is sent.

KeyRotate for Windows also asks frontierstack.app every few hours whether a newer version exists, and downloads it if so. That request carries only the version and the kind of processor (x64 or Arm). You can turn the automatic check off in Settings › Updates.

If you reached the purchase page through a partner’s link, the partner’s code travels in the page address to checkout so we can credit them; nothing is stored in your browser for it, and the partner sees only totals. The frontierstack.app privacy policy describes it in full.

Backups

An encrypted backup you export contains your key values and the vault's settings, sealed with a key derived from a passphrase you choose. The file goes wherever you save it. Enfour cannot read it and cannot recover it if the passphrase is lost.

Children

KeyRotate is a developer tool and is not directed at children.

Retention and your choices

Because Enfour holds no data about you, there is nothing for you to request access to, correct or delete from us. Deleting the app removes its container data. Keychain items may remain until removed by the operating system or a later installation; you can delete them yourself in Keychain Access.

Support

If you contact support, we receive what you choose to send and use it to answer your request. Do not include key values or other secrets in a support message.

Contact and changes

Questions about this policy can be sent to support at frontierstack dot app. We may update this policy as the app or legal requirements change; the effective date above shows the latest revision.