Privacy Policy

1. Information We Collect

Account Information

When you register, we collect your email address. This is used solely for account identification and communication.

API Keys

Your API key is your credential and is shown to you only once at creation. We store only a keyed hash (HMAC-SHA256) of the key plus a masked preview (e.g. sk_live_abc…wxyz) — never the full key — so a database leak cannot expose usable credentials. Rotation replaces the stored hash.

API Usage Data

We keep aggregate, per-day counters only — total request count, total HTML size processed, and total response time. We do not store IP addresses and we do not store the HTML content you submit. Content is processed in memory only and discarded immediately after the inlining operation completes.

Payment Information

Payments are processed by PayPal (paypal.com). We do not store or process credit card information. Payment records kept for accounting reference are de-identified: any API-key material is replaced by a one-way hash before storage.

2. Third-Party Services

• PayPal (paypal.com) — Payment processing
• Vercel (vercel.com) — Hosting
• Upstash (upstash.com) — Redis database

3. Data Retention

Aggregate usage counters are kept for at most 45 days, then automatically deleted. Share links expire by default after 7 days (configurable up to 30 days), and revoked or expired links stop working immediately. Saved projects do not expire automatically — they are kept until you delete them (individually, or together with your account). Account data is retained until you request deletion.

4. Account Deletion

You can delete your account yourself from the Dashboard’s Billing & Danger Zone panel by confirming with your saved API key. Deletion removes your API keys, usage records, saved projects, screenshots, share links, and refund requests. If you have an active paid subscription, deletion is blocked until you cancel it first, so billing is never orphaned.

Minimal payment records required for accounting/fraud-prevention purposes survive deletion in de-identified form (API-key material irreversibly hashed; no email or account link), as noted in section 1. These pseudonymous records are kept for at most 45 days after deletion. Residual aggregate counters that cannot be attributed to you (random key identifiers only) expire automatically within 45 days.

5. Your Rights (GDPR)

If you are in the EU, you have the right to access, correct, or delete your personal data. Self-service deletion is available in the Dashboard as described above; otherwise email ababwooohallo@163.com.

6. Contact

ababwooohallo@163.com