Privacy Policy

This Privacy Policy explains what data renderapi (a product of SQEasy Club LTD) collects, why, and how it is stored. It is written to describe what the service actually does, not generic boilerplate — this reflects the current implementation.

1. Data we collect

• Account email. The email address you register with, used to identify your account and to match a Stripe subscription to your API key at checkout.
• API key (hashed only). Your raw API key is shown to you once, at creation, and is never stored. We store only a one-way SHA-256 hash of it, used to authenticate requests.
• Usage records. Each render request is logged with the target URL, output format (PNG/PDF), whether it was served from cache, render duration, and a timestamp. This is used for quota enforcement, billing accuracy, and abuse detection.
• Billing identifiers. Your Stripe customer ID and subscription ID are stored so we can keep your account's tier and subscription status in sync with Stripe. We never see or store your card number — Stripe collects and processes payment details directly.
• IP address (temporary). Your IP address is recorded briefly to enforce rate limits on account signup and on free-tier rendering, so a scripted signup or render burst from one source can't be used to abuse the free tier or degrade the service for paying customers. It is not used for tracking or analytics.

2. Rendered content caching

To avoid re-rendering the same page twice, the output of a render is cached in Cloudflare R2 under a key derived from a hash of the render parameters (target URL, format, viewport, and related options) — not from your account or API key. This means that if two different customers request an identical render (same URL and options), they may be served the same cached file. Cached render output is not labeled with, or searchable by, any customer's identity.

3. Cookies

renderapi does not set or read browser cookies. The dashboard is accessed using your API key directly, not a browser session.

4. Who we share data with

• Stripe — processes payments and subscriptions; receives your checkout email and payment details directly.
• Cloudflare — our infrastructure provider. All data described above is processed and stored on Cloudflare's platform (Workers, D1 database, R2 storage, Browser Rendering).

We do not sell your data, and we do not use it for advertising.

5. Data retention

Account, API key, and usage records are retained for as long as your account is active, plus a reasonable period afterward for billing and dispute records. Cached render output in R2 is keyed by content hash rather than by account, so it may persist independently of any specific account and is not selectively deletable per customer.

6. Your rights

You can request deletion of your account and associated data by contacting us at the address below. Because one email address maps to one API key, deleting your account stops further billing and quota tracking for that key.

7. Security

API keys are stored only as SHA-256 hashes, never in plaintext. Webhook payloads from Stripe are verified with an HMAC signature check before being trusted. All traffic to renderapi is served over HTTPS via Cloudflare.

8. Changes to this policy

We may update this Privacy Policy from time to time; the effective date at the top of this page will reflect the most recent revision.

9. Contact

Privacy questions or data-deletion requests can be sent to admin@toxot.net.