Privacy Policy

0. Who we are

The data controller is ZHOU QINGFENG, an individual (sole proprietor), People’s Republic of China. Privacy questions: [CONTACT, [email protected]].

1. Information we collect

• Email address (required for sign-up and API key delivery).
• Name (optional, if you provide it).
• API keys: stored only as salted SHA-256 hashes; a short non-secret prefix is stored for log correlation. Plaintext keys are shown once at creation and never logged.
• Usage logs: hashed key reference, endpoint, status code, timestamp. No IP addresses are stored in usage logs.
• Sign-up attempt records: email and IP address, used solely for rate limiting and abuse prevention (e.g. Cloudflare Turnstile verification).

2. How we use information

To operate the service, enforce quotas and abuse prevention, and provide support.

Legal bases (GDPR/UK): we process personal data to perform the contract with you (creating and managing your account and API access), for our legitimate interests in operating, securing and improving the Service (abuse prevention, quota enforcement), and to comply with legal obligations. Where consent is required for any purpose, we will ask for it separately.

3. Retention

Account data (email, name, key hash) is kept while your account is active and deleted on account deletion. Usage logs and sign-up attempt records are retained for a limited period for security and quota purposes and then deleted after 90 days.

4. Your rights

Depending on your jurisdiction (in particular the EU/UK GDPR and California CCPA/CPRA), you may have rights to access, correct, delete, restrict or port your personal data, and to object to processing. To exercise any right, email [CONTACT]. We will respond within 30 days (EU/UK) or as required by law. To delete your account and data, email [CONTACT]; we will process deletion within 10 business days.

5. Third-party processors

• Cloudflare (hosting, CDN, D1 database storage, Turnstile bot protection) — cloudflare.com/privacy
• Paddle (payment processing, Merchant of Record) — paddle.com/privacy
• Gumroad (backup payment processing) — gumroad.com/privacy

We do not sell or share personal data (California CPRA: “Do Not Sell or Share My Personal Information” — we do not sell or share).

6. International transfers

The Service is operated on Cloudflare’s global network; personal data may be stored in or transferred to data centers outside your country of residence, including the United States. Cloudflare provides safeguards for international data transfers (including its EU-U.S. Data Privacy Framework certification). Primary database storage region: United States (Cloudflare D1, West North America / San Jose).

If you are located in mainland China: your personal data will be transferred to and processed on servers outside mainland China (e.g., Cloudflare’s global network) in order to provide the Service. By providing your data you acknowledge and consent to such cross-border transfer as described in this policy.

7. Cookies & analytics

The Service does not use cookies for advertising or third-party analytics, and we do not track you across sites. Cloudflare (our hosting and security provider) may set strictly necessary security cookies to protect the Service; Cloudflare Turnstile is used on the sign-up form to prevent abuse.

8. Security

We use salted hashing for API keys, TLS encryption, and rate limiting. No method of transmission is 100% secure, and we cannot guarantee absolute security.

9. Children

The Service is not directed to children under 13 (or the applicable age of digital consent in your country) and we do not knowingly collect their data.

10. Policy updates

We may update this policy; the “Last updated” date will reflect changes, and material changes will be announced on this page.