PRIVACY
What this site processes.
openckey.org is a small service. It sets no cookies of its own, runs no advertising, and has no analytics. This page lists everything it does process.
Last updated 5 November 2026.
Hosting and network
The site runs on Cloudflare Workers. As the host and content delivery network, Cloudflare necessarily sees each visitor’s IP address and request details to deliver pages and protect the service. The site’s own logs are structured events that contain no IP addresses, payloads, URLs, or tokens.
Creating a destination
- Cloudflare Turnstile checks that a person is creating the record. Turnstile runs in your browser on the home page and the report page only, and Cloudflare processes the signals it needs for that check. The site verifies the token on the server and does not keep it.
- Rate limiting uses your IP address as a short-lived key in Cloudflare’s rate limiter. It is not written to the database.
- Cloudflare URL Scanner receives every short query destination — and, for an expiring link that falls back to the host’s home page, that home page too — for an unlisted safety scan before the link activates. Scan reports are held by Cloudflare under its own terms.
What is stored
- Records. Hosted text, short query destinations, the chosen design and expiry, the safety status, and scan identifiers are stored in a Cloudflare D1 database. They are not linked to who created them.
- Retention. A record is kept for up to 24 months (an administrator may extend this in limited cases, with a logged reason). Then a scheduled retirement removes the text or destination and keeps only the reserved identifier and a retirement marker, so the identifier is never reused. Early expiry stops a record working sooner but does not free its identifier.
- Abuse reports store the reported route and identifier, the reason, and any details you write. No IP address is stored with a report, and the details are erased after 24 months.
- SDK telemetry is stored only as daily aggregate counts, with no IP addresses, for 400 days. See Telemetry.
The renderer
The renderer runs the CKey core in your browser. What you type is not sent to this site. If you open the renderer from a link that contains ?data=, that link — like any address you visit — is part of the request Cloudflare delivers.
What the site never does
- No advertising, analytics, or tracking scripts, and no cookies set by the site. Turnstile may use its own browser storage to do its check.
- Hosted text pages contain only the text: no site scripts, navigation, or tracking.
- No sale or sharing of data beyond the processors named here.
Contact
For privacy questions, open an issue on the CKey project on GitHub. For security reports, use a private security advisory. To report a harmful link, use the report form.