Stored information and purposes
The service stores email, password hashes, API key hashes and prefixes, credit usage, abuse-related information including IP information, and payment transaction records. These support account access, retrieval authentication, credit accounting, abuse prevention and payment verification. Passwords and API keys are not stored as plaintext account secrets. Listing stored categories does not authorize publication of actual hashes, personal information or payment records, and hashing does not guarantee protection against every form of unauthorized access.
Browser state and sessions
The account widget saves invoice and user identifiers in localStorage separately for each hostname to recover saved invoice state. The raw API key is not persisted there. A Secure HttpOnly session cookie serves account authentication separately from the retrieval key header. HttpOnly applies to that cookie, not localStorage. Your application’s server credentials are a separate responsibility: do not expose its archive key in public code, logs or responses merely because you signed into the account panel.
Analytics and retention boundaries
Pages include Statinside analytics counter 43 for website analytics. No exact provider data-field list or cookie behavior is specified here. No fixed retention or automatic-deletion deadline is established for account information. That does not promise indefinite storage, a particular deletion date or a user-operated deletion workflow. It also says nothing about archive record permanence or availability. Responses you retain in your own integration are distinct from the service’s account and payment records and need their own handling decisions.
