Privacy policy

We collect only what the service needs to work. In practice that is four things.

• Account details. Your name, email address and a hashed password. We never store your password itself.
• Sites and API keys. The names you give your sites and their keys. Keys are stored as hashes — after a key is issued we cannot show it to you again, only replace it.
• Usage records. For each site, when requests were made and how many. This is what drives your usage dashboard and enforces your plan limits.
• Billing records. Deposits into your balance, including the cryptocurrency transaction reference you supply, and the subscription charges drawn from that balance.

We also keep ordinary server logs — IP address, timestamp, endpoint, response status — for security and for diagnosing faults.

We do not ask for a phone number, a physical address, a date of birth, or any payment card details. We do not run advertising trackers on this site.

Each category is used for a specific purpose and not repurposed:

• To authenticate you and authorise API requests made with your keys.
• To count requests against your plan limits and show you your own usage.
• To take payment from your balance and keep an accurate record of it.
• To contact you about your account — a lapsed subscription, a security matter, or a change to these terms.
• To protect the service against abuse, and to investigate faults when something breaks.

Our lawful basis is performance of the contract between us for most of the above, and our legitimate interest in running a secure and reliable service for logging and abuse prevention.

We send service email: account notices, security alerts, billing confirmations and material changes to the terms. These are part of the service and you cannot opt out of them while you hold an account.

We do not sell your email address, and we do not pass it to third parties for their own marketing.

We do not sell personal data, and we do not share it for anyone else's marketing.

We share data only with the providers that make the service run — hosting and infrastructure, and email delivery — and only to the extent they need it to perform that work. They act on our instructions.

We may disclose data where we are legally required to, or where it is necessary to establish or defend a legal claim. If we are ever compelled to hand over your data and are permitted to tell you, we will.

• Account details — for as long as your account is open.
• Usage records — kept as a rolling history so you can review your own consumption, then aggregated or removed.
• Billing records — retained for as long as required to meet accounting and tax obligations, which may outlast your account.
• Server logs — kept for a short period for security and diagnostics, then discarded.

When you close your account we delete or anonymise what we are not required to keep.

Passwords are hashed and API keys are stored as hashes, so neither exists in readable form in our database. Traffic to the site and the API is encrypted in transit.

Access to production data is limited to the people who need it to operate the service.

No system is perfectly secure. If a breach affects your personal data and creates a real risk to you, we will tell you and the relevant authority without undue delay.

You can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything that is wrong — most of it you can edit yourself in the dashboard.
• Delete your account and the data attached to it, subject to records we must keep for accounting.
• Restrict or object to a particular use of your data.
• Provide your data in a portable, machine-readable form.

Write to [email protected] and we will respond within 30 days. We will not charge you for a reasonable request, and we will not treat you differently for making one.

If you believe we have handled your data improperly, you may complain to the data protection authority in your jurisdiction.

We use a small number of strictly necessary cookies: one to keep you signed in, and one to protect forms against cross-site request forgery. Both are required for the site to function.

We do not use advertising cookies, and we do not run third-party analytics that profile you across other websites. There is nothing here to opt out of.

We are based in Dubai, United Arab Emirates. Our infrastructure providers may process data in other countries, in which case we rely on appropriate safeguards for that transfer.

The market data we serve is not personal data — it is public market information, and it is unconnected to any individual.

The service is intended for businesses and for professional use. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, write to us and we will remove it.

If we change how we handle personal data we will update this page and move the date at the top. Where a change is material, we will tell account holders by email before it takes effect.

Questions about this policy go to [email protected].