How we treat your data and your users’ data.
beginner · about 3 min · 4 steps
API keys are hashed at rest and shown only once.
After the first reveal we only display a masked prefix. If a key is lost, rotate it — the old one stops working immediately.
End-user identifiers (emails, phones) are stored as deterministic salted hashes — we never hold raw identifiers.
You can match your own users across clicks and conversions without handing us personal data in the clear.
Your data is isolated per publisher workspace.
Every record is scoped to your workspace; no other publisher can see your links, clicks, or earnings.
Full details are in the privacy policy at capitis.app/privacy.