Privacy
Keys, not conversations
The API stores what it needs to authenticate a key and count requests. It does not sell data and it does not train models.
What is stored
Your account. An account id, your email address (lowercased, used only to sign you in and to reach you about your keys), and the creation time. Accounts made before email sign-in have no email.
Sign-in links. For each link we store a SHA-256 hash of the link token and of the 6-digit code, the email it was sent to, and when it was created, expires (15 minutes), and was used. The link and the code themselves are never stored. Rows are deleted about a day after they expire.
Sessions. When you sign in, your browser gets a random token in an HttpOnly cookie (tw_session, 30 days). We store only its SHA-256 hash, the account id, and its start, expiry, and sign-out times, so Sign out ends it on the server. Ended sessions are deleted about a day later.
Keys. The SHA-256 hash of each key, its last four characters, the plan name, and creation and revocation times. The full key is shown once and is not stored.
Counters. Aggregate request counts per key, per account, and per network address, for the current minute, hour, or UTC day, plus sign-in attempt counts. Network addresses and emails in counters are stored only as keyed hashes, never in clear. Counters are operational, not an archive.
Logs. A request id, a key id, the route, the duration, the status, and the quota count. They do not keep the query string, the key, your email, or any conversation.
Who sees it
Sign-in email is sent through our email provider (Resend), which receives your address and the message. When the bot check is on, Cloudflare Turnstile sees your browser for that check. Nothing is sold, and nothing is used to train models. Another account cannot list your keys or your counts.
Retention and deletion
A revoked key stops working at once. Keys of old anonymous accounts stop on 19 November 2026 unless an email is attached. To delete your account, keys, and email, write through the contact page from the email you signed in with.
Until a database is configured, production does not create accounts. Local development may keep a file under .data on the machine that runs the app. That file is not part of the site repository.