🔑 The short version on your API key
Your model API key is encrypted at rest and decrypted only inside your own sandbox's memory, for the length of a run. It is wiped on teardown, and never written to logs or returned to your browser. We never see it in plaintext outside that moment, and we never resell your tokens.
01 Introduction
This Privacy Policy explains what data Saki Studio ("we", "us") collects when you use the Service, why, and what choices you have. It should be read alongside our Terms & Conditions.
02 Who we are
Saki Studio is a hosted developer tool run as an independent, personal project by an individual (not a registered company), currently in private beta. For any privacy question or request, contact saki@saketek.id.
03 What we collect
| Category | Examples | Why |
|---|
| Account | Google account identifier and email | Create and secure your account |
| Billing | Subscription status, Stripe customer ID (card details handled by Stripe — we never store them) | Run the paid subscription |
| Credentials | Your model API key, stored encrypted | Run builds with your provider (see §4) |
| Your Content | Specs, prompts, generated code and build artifacts | Operate the pipeline for you |
| Usage & telemetry | Funnel events (signup, key-added, subscription, first build), compute minutes, run outcomes, basic logs | Provide, secure, meter, and improve the Service |
04 Your API key
- Your key is encrypted at rest and decrypted only inside your isolated sandbox's memory, for the duration of a run.
- It is wiped on teardown — when a run completes or the sandbox is idle-reaped — and is never written to logs, our stream output, or returned to any client.
- We do not use your key for anything other than running your own builds, and we do not resell or meter your model tokens.
- Your prompts and inputs are sent to your chosen model provider using your key; their handling of that data is governed by their own privacy terms.
05 How we use data
- To provide the Service — run the PRD → proto → build → QA → review pipeline and return your artifacts.
- To handle authentication, subscriptions, and billing.
- To secure the platform, meter usage against plan limits, and control cost.
- To understand activation and improve the product (aggregated funnel and reliability metrics).
We do not sell your personal data, and we do not use Your Content to train models.
06 Sharing & subprocessors
We share data only with the providers needed to run the Service:
- Google — sign-in / authentication.
- Stripe — payment processing and subscription billing.
- Your model provider (e.g. Anthropic, or a supported budget provider) — receives your prompts via your key.
- Cloud infrastructure provider — hosting and the ephemeral sandbox compute.
We may also disclose data where required by law, or to protect the Service and its users.
07 Retention
We keep account and billing records for as long as your account is active and as needed for legal and accounting purposes. Sandbox contents and decrypted keys exist only for the duration of a run and are destroyed on teardown. You can delete your stored key or account at any time (see §9).
08 Security
We use encryption in transit and at rest, tenant sandbox isolation, and least-privilege access to protect your data. No system is perfectly secure, but key handling is designed so your credential is never persisted in plaintext or exposed outside its sandbox.
09 Your rights
- Access the personal data we hold about you, and request a copy.
- Correct inaccurate data, or delete your stored key or your whole account.
- Export Your Content (build artifacts).
- Object to or restrict certain processing, subject to applicable law.
To exercise any of these, contact saki@saketek.id. Depending on where you live, you may also have rights under GDPR, UK GDPR, or CCPA/CPRA.
10 Cookies
We use only the essential cookies needed to keep you signed in and to run the Service securely. We don't use advertising or cross-site tracking cookies.
11 Children
The Service isn't directed to children and isn't intended for anyone under 16 (or the age of digital consent in your country). We don't knowingly collect data from children.
12 Changes & contact
We may update this policy; material changes will be posted here with a new "last updated" date. Questions or requests? Contact saki@saketek.id.