Stored information and purposes
We store your email, password hash (not plaintext), API key hash, abuse prevention IP data, and payment records for account access and authentication. Disclosing these storage categories constitutes public policy information but does not authorize exposing your actual credential hashes or personal data publicly. The stored key information includes its prefix, and account records also include credit usage. No plaintext password or key is retained as an account secret.
Browser state and sessions
The account widget saves invoice and user identifiers in localStorage separately for each hostname to recover saved invoice state. The raw API key is not persisted there. A Secure HttpOnly session cookie serves account authentication separately from the retrieval key header. HttpOnly applies to that cookie, not localStorage. Your application’s server credentials are a separate responsibility: do not expose its archive key in public code, logs or responses merely because you signed into the account panel.
Analytics and retention boundaries
Pages include Statinside analytics counter 43 for website analytics. No exact provider data-field list or cookie behavior is specified here. No fixed retention or automatic-deletion deadline is established for account information. That does not promise indefinite storage, a particular deletion date or a user-operated deletion workflow. It also says nothing about archive record permanence or availability. Responses you retain in your own integration are distinct from the service’s account and payment records and need their own handling decisions.
