Keys stay on your Mac.
Effective 26 September 2026
A. Short version
Your API keys are stored in the macOS Keychain, on your Mac. Claude Keychain is free and does not require an account. The app has no analytics and no crash reporter. It makes two kinds of outbound requests: a lookup of a small icon for a service you add a key for, and a periodic check for app updates. Neither ever includes a secret's name or value.
B. What the app reads and writes on your Mac
The macOS Keychain. Each secret is stored as its own Keychain item, under the service name claude-vault, holding the value you typed in. This is the only place a secret's value is ever written.
~/.claude-vault/index.json. The name of each secret and its metadata: when it was added, when it was last used, and its cached icon. Never the value.
~/.claude-vault/audit.log. A record of when a secret was used and what triggered it, the app's own interface or a command run through Claude Code, including that command's name. Never the secret's value.
~/.claude-vault/settings.json. Your preferences: how long a copied secret stays on your clipboard, the app's accent color, and whether you've finished setup. All of it stays in this file, in plain text, on your Mac; nothing in the app's current code reads this file over the network.
~/.claude-vault/icons/. Cached icon images for the services you've added keys for.
~/.claude-vault/server.log. The background server's own startup and error log. It does not write secret values to this file.
~/.claude/CLAUDE.md and ~/.claude.json. When you connect Claude Code, Claude Keychain edits these two files, which belong to Claude Code, to register itself and add one instruction telling Claude Code to check for a stored secret before asking you to paste one.
A login item. Created only if you turn on "Open at Login" in Settings.
Claude Keychain does not ask for access to your camera, microphone, documents, or screen recording, and its app permissions do not request any of them. Revealing a secret can ask for Touch ID or your Mac password first; that prompt is handled entirely by macOS, and Claude Keychain only ever receives a yes or no, never your fingerprint or password.
C. Network
Claude Keychain makes two kinds of outbound requests, and nothing else.
Icon lookup. When you add a secret, or set its icon manually, it asks a public icon service for a small logo matching the service's guessed domain (for example, a secret named STRIPE_KEY sends a request for stripe.com's icon, not the secret's name or value). That request is cached, so the same secret does not trigger it again. If you're offline, adding a secret still works; it just won't have an icon yet.
Update check. The app periodically checks whether a newer version is available. This request contains the app's current version number and nothing else; it never includes a secret's name or value.
Beyond these two, the app does not run any analytics or crash-reporting software. If a future version adds anything else, this page will say so before that version ships.
D. This website
This site uses DataFast to see which pages and marketing channels bring visitors, routed through our own subdomain rather than loading directly from DataFast's domain. DataFast's own script sets a cookie and reads your IP address to do this; it's why you're shown a cookie choice on your first visit, and analytics only loads if you accept it. We also run our own cookieless visit counter on our own server. It records the page you view, the site that linked you here, your approximate country and city, and your browser and device type. It sets no cookies, stores nothing on your device and doesn't keep your IP address: to count unique visitors it uses a one-way code made from your IP address and browser plus a random value that is discarded after two days. We don't run any other analytics, advertising pixel, or tracking script.
To download Claude Keychain you enter your email address. It's entirely optional and never required to download or use the app. We store it with the time, your IP address and whether you ticked “Email me about updates”, on the same infrastructure as the rest of this site (Cloudflare). We use it to know who downloaded the app and, only if you ticked the box, to email you about Claude Keychain updates and new projects. You can unsubscribe at any time and ask us to delete your email whenever you like. No third party sees it. Email [email protected] at any time to unsubscribe or have it deleted.
E. Your rights and how to reach us
You can ask what we hold about you, and ask us to delete it, at the address below. We can delete what's in our own records, such as emails you've sent us; we cannot delete anything already stored in your own Mac's Keychain, that's yours to remove at any time from within Claude Keychain or Keychain Access. A person reads and answers privacy requests sent to [email protected].