Privacy

Written to be read. If something here is vague, that is a fault worth telling us about.

What we hold

• Your email and a password hash. The password itself is never stored — only an argon2id hash, which cannot be turned back into your password. If you sign in with Google we store the email Google confirms and no password at all.
• Your API keys, hashed. A key is shown once when you create it and stored only as a hash and a short prefix. We cannot recover a lost key; you revoke it and make another.
• A log of your API calls — endpoint, the query parameters you sent, credits charged, whether it was served from cache, the status, and when. This is what fills your usage page, and it is how a billing dispute gets settled.
• Your credit ledger and top-ups — amount, the payment reference from OxaPay, and status. We never see or store card or wallet details.
• Messages you send us, with the address you sent them from and the IP the form was submitted from.

What we do not do

We do not sell your data, share it with advertisers, or use it to train anything. There are no analytics scripts, no advertising pixels and no third-party trackers on this site — the only cookie we set is the one that keeps you signed in.

Who else is involved

How long we keep it

Your account and ledger stay while the account exists — the ledger is append-only, because a record of money that can be edited is not a record. Request logs are kept for 12 months. Ask us to delete your account and we delete it, along with your keys, logs and messages, keeping only what we must to show a payment happened.

Your side of it

Ask for a copy of what we hold, ask for a correction, or ask for deletion, and write to us. No form, no process — one person reads it and does it.