What happens to your keys

Encrypted at rest

Every credential you give us (the .p8 private key, a Stripe restricted key, a Google Play service-account file, an Apple Ads key) is encrypted with AES-256-GCM before it is written to the database. The encryption key is a Cloudflare Worker secret, held apart from the database, so a copy of the database alone cannot decrypt anything. GCM is authenticated: a tampered value fails to decrypt instead of producing garbage. Keys are decrypted in memory only when RevenueHog calls Apple, Stripe or Google on your behalf, and the dashboard never shows a stored key back to anyone.

The least access that works

Give the App Store Connect key the lowest role that covers what you want. RevenueHog detects the role and shows which features it unlocks in Settings.

For Stripe, RevenueHog accepts restricted keys only (rk_live_ or rk_test_) and rejects secret keys. The setup asks for read permissions on customers, subscriptions, invoices, charges, products, prices, payouts, balance and events. Webhook Endpoints write is optional; without it RevenueHog polls instead of registering a webhook.

Rotation and deletion

Upload a new .p8 in Settings and the old encrypted copy is overwritten. Remove a credential and the row is deleted. Delete your account and every workspace you were the last member of is deleted with it, including stored keys and imported data; see account deletion.

Where it runs

The full data inventory is in the privacy policy.

Report a problem

Found a vulnerability or think a key was exposed? Email privacy@revenuehog.dev. If a key may be exposed, revoke it at Apple or Stripe first: that takes effect immediately.