Explain Access Keys

Dear Bitbucket,

I'm using DeployHQ to automate deployments. I have pasted the SSH key generated by DeployHQ in my Bitbucket.

But it is not at all clear to me, which rights I have granted to DeployHQ with adding this SSH key. I'm guessing DeployHQ can now access all repositories (private and public) I have access to. And DeployHQ can make a commit or other changes via the SSH key under my name.

It would be great if a SSH key can be restricted:

1. To ONE repository
2. To be READONLY

Kind regards,
Mirco Babin