Legal

Privacy notice

Last updated 13 October 2026

What we keep about you, why, who else handles it, and how to have it deleted.

Little keptEmail, name, plan, key fingerprints and usage counts.
No card detailsStripe keeps the card. Nothing is sold, no ad tracking.
Gone in 30 daysDelete your account yourself and it is gone within 30 days.

The operator and data controller for this website is DeveloperData.net (Developer Data), Empire Tower, 41st Floor, Unit 4106-7, South Sathorn Road, Yannawa, Sathorn, Bangkok 10120, Thailand. Contact: [email protected].

01What we keep

  • Your account: your email address, your name, your plan and the country you signed up from.
  • Your API keys, only as a fingerprint, never the key itself. We cannot show you a key again after it is made.
  • Usage counts: calls per key per day, and refused calls with their reason.
  • Support tickets you open.
  • Page and API logs, including the address a request came from.

02Card details

  • Card details are never held by us. Stripe takes the payment and keeps the card; we see only the card brand, its last four digits and its expiry month.

03Why we keep each one

  • To run the API, bill it, answer support, stop abuse and keep it secure. Nothing is sold, and there is no advertising tracking.

04Who else handles it

  • Stripe, for payments.
  • Cloudflare, for the network and security in front of the website and the API.
  • Our email provider, through Developer Data, for sign-up, key and billing emails.
  • Google, for signing in. Google sign-in shares your name, email address and profile picture with Developer Data; we keep the name and email address and do not keep the picture.
  • The hosting company that runs our servers.

05Google sign-in while signed out

  • While you are signed out, our pages load Google's sign-in script so the "Continue with Google" button and pop-up can work. Google then receives your IP address and may use its own cookies, under Google's privacy policy.

06Cookies and browser storage

  • handballapi_session: keeps you signed in. Set when you sign in, removed when you sign out or after 30 days without a visit.
  • handballapi_ot: a random value that protects Google sign-in from forged requests. Lasts ten minutes.
  • handballapi_out: a marker that stops Google's pop-up opening again straight after you sign out. Lasts one minute.
  • ap_click: first-party; remembers which partner sent you, so the partner can be credited for a purchase. Holds no personal details and lasts 60 days; a newer partner link replaces it.
  • If you paste your key into the documentation, your browser keeps it in its own local storage so you need not paste it again. It stays in your browser; Forget removes it.
  • No third-party analytics cookies.

07How long it is kept

  • The account and its keys: while the account is open.
  • After the account is deleted: gone within 30 days, backups included.
  • Billing records (invoices, payments): kept as long as tax and accounting law requires, even after the account is deleted.
  • Page, API and security logs: 30 days. API error details: 14 days.
  • Support tickets: while the account is open, then deleted with it.

08Your rights

  • You can see what we hold, have it corrected, take a copy, or have it deleted.
  • Ask through support; we answer within 30 days.

09Deleting your account

  • You do it yourself: Settings, then Delete my account. A confirmation lists what will happen and asks you to tick a box first.
  • Your plan is cancelled at once and the unused part is not refunded. Every key stops working at once. You are signed out.
  • The account and its history are deleted within 30 days. Billing records stay as the law requires, tied to the payment record, not to a live account.
  • We email you when it is done. If you cannot sign in, ask through support and we delete it for you.

10Children

  • The API and this website are not for anyone under 18.

11Changes

  • Changes are posted here with the date. A change that matters is emailed to members first.