diff --git a/pushbullet_cli/app.py b/pushbullet_cli/app.py
index <HASH>..<HASH> 100755
--- a/pushbullet_cli/app.py
+++ b/pushbullet_cli/app.py
@@ -1,16 +1,26 @@
 #!/usr/bin/env python
 
 import argparse
+import os
 import os.path
 import requests
 import re
 import sys
+from contextlib import contextmanager
 
 PUSH_URL = "https://api.pushbullet.com/api/pushes"
 DEVICE_URL = "https://api.pushbullet.com/api/devices"
 KEY_PATH = os.path.expanduser("~/.pushbulletkey")
 URL_RE = re.compile(r"^[a-zA-Z]+://.+$")
 
+@contextmanager
+def private_files():
+    oldmask = os.umask(077)
+    try:
+        yield
+    finally:
+        os.umask(oldmask)
+
 
 class PushbulletException(Exception):
     pass
@@ -48,7 +58,7 @@ def _get_api_key():
         print("What's your API key?")
         print("Find it at <https://www.pushbullet.com/account>.")
         api_key = raw_input("> ").strip()
-        with open(KEY_PATH, "w") as api_file:
+        with private_files(), open(KEY_PATH, "w") as api_file:
             api_file.write(api_key)
 
         return api_key
Key file should be created with private permissions