Security & privacy

How we treat your data and your users’ data.

1. 1
   API keys are hashed at rest and shown only once.

   After the first reveal we only display a masked prefix. If a key is lost, rotate it — the old one stops working immediately.
2. 2
   End-user identifiers (emails, phones) are stored as deterministic salted hashes — we never hold raw identifiers.

   You can match your own users across clicks and conversions without handing us personal data in the clear.
3. 3
   Your data is isolated per publisher workspace.

   Every record is scoped to your workspace; no other publisher can see your links, clicks, or earnings.
4. 4
   Full details are in the privacy policy at capitis.app/privacy.