Privacy Policy
Last updated: 2026-10-13
Summary
We collect minimal data necessary to operate the API and process payments. No personal identifiable information (PII) is required for free tier usage. No tracking, no analytics cookies, no third-party data sharing.
Data We Collect
| Data | Purpose | Retention | Legal Basis |
|---|---|---|---|
| API Key (hashed) | Rate limiting, tier enforcement | While key active + 90 days | Contract performance |
| Request metadata (IP, endpoint, timestamp) | Rate limiting, abuse detection, capacity planning | 24 hours (aggregated) | Legitimate interest |
| x402 payment payload (signed authorization) | Payment verification and settlement via the Coinbase CDP facilitator | Not stored by us (forwarded to the facilitator and discarded) | Contract performance |
| Payment recipient address (our wallet) | Receiving USDC payments on Base | Public on-chain data (visible to anyone, by the nature of the blockchain) | Legal obligation |
What We DON'T Collect
- No personal names, addresses, phone numbers
- No cookies, localStorage, or tracking pixels
- No Google Analytics, Mixpanel, or third-party trackers
- No query parameters or request bodies logged
- No user behavior profiling
Data Processing
Cloudflare Workers (Edge)
Requests process at Cloudflare edge. Cloudflare's privacy policy applies to their processing. We do not control their logs.
Coinbase CDP (Payments)
x402 payments process via Coinbase CDP on Base network. Coinbase's privacy policy applies. We receive only transaction hash and wallet address.
RapidAPI (Marketplace)
If you subscribe via RapidAPI, RapidAPI's privacy policy applies to the billing relationship. We receive only the request and the subscription status of requests that arrive through their runtime.
Data Sharing
We do not sell or share your data with third parties.
Exceptions (minimal, required for operation):
- Coinbase CDP: the signed payment payload, for verification and settlement only
- RapidAPI: subscription status (plan, expiry) for access control
- Legal: only if required by court order (never happened)
Data Retention & Deletion
- Request logs: auto-deleted after 24 hours (aggregated metrics kept)
- API keys: deleted 90 days after revocation
- Payment records: 7 years (Japanese tax law)
- Email: deleted 1 year after last activity
- Right to erasure: email us → deleted within 30 days (except tax records)
Your Rights (GDPR/APPI)
- Access: Email us for copy of your data
- Rectification: Email us to correct inaccuracies
- Erasure: Email us → deleted in 30 days (except tax records)
- Portability: Data provided in JSON format
- Objection: Opt out of any processing at any time
Contact: Contact Form
International Transfers
Cloudflare (US), Coinbase (US) may process data outside Japan. Both are Privacy Shield certified / have Standard Contractual Clauses. No other international transfers.
Security
- API keys: stored as bcrypt hashes (not reversible)
- Payment data: only tx hashes + wallet addresses (no private keys)
- TLS 1.3 enforced on all endpoints
- No database - stateless edge functions (Cloudflare Workers)
Children's Privacy
Service not directed at children under 16. We don't knowingly collect children's data.
Changes
Material changes notified via email (paid users) or website notice 30 days prior. Continued use = acceptance.
Contact
Data protection inquiries: Contact Form
Subject line: "Privacy / Data Protection"