Privacy policy

01What we keep

• Your account: your email address, your name and your Google account id, from signing in with Google, and your plan.
• What you put in: your webhook addresses and their descriptions.
• API keys, only as a fingerprint, never the key itself.
• Usage counts: calls a day for each key and endpoint.
• Support tickets.
• Page, API and security logs.

02Signing in with Google

We offer sign-in with Google only. When you sign in, Google tells us your email address, your name and an id for your Google account, and that Google has checked the email. We never see your Google password, and we ask Google for nothing else: no contacts, no files, no calendar. You can remove BoxingAPI's access from your Google account at any time; your BoxingAPI account stays until you delete it.

03Card details

Card details are never held by us. Stripe takes the payment and keeps the card.

04Why we keep it

To run BoxingAPI, bill it, answer support, stop abuse and keep it secure. Nothing is sold, and there is no advertising tracking.

05Who else handles it

• Stripe, for payments.
• Cloudflare, for the network and security.
• Google, for sign-in.
• Our email provider, through Developer Data, for account and billing emails.
• Our hosting company.

06Cookies

• bx_s: your sign-in session, while you are signed in.
• bx_f: a one-off message after an action, gone once shown.
• ap_click: first-party; it remembers which partner sent you so they can be credited for a purchase. It holds no personal details and lasts 60 days; a newer partner link replaces it.
• Google's sign-in, on the sign-in page, may set its own cookie to remember that you closed its prompt.

No third-party analytics cookies. The documentation keeps your API key in your own browser, so Try it works without pasting it; Forget clears it.

07How long it is kept

• Your account and what you put in: while the account is open.
• After the account is deleted: gone within 30 days, backups included.
• Billing records: as long as tax and accounting law requires, even after the account is deleted.
• Page, API and security logs: 30 days.
• Support tickets: while the account is open, then deleted with it.

08Your rights

To see what we hold, have it corrected, take a copy, or have it deleted. Ask through Support; we answer within 30 days.

09Deleting your account

Delete my account, in your account, cancels any subscription at once (the unused part is not refunded), stops every API key, signs you out, and deletes the account within 30 days. Billing records stay as the law requires. If you cannot sign in, ask through Support.

10Children

BoxingAPI is not for anyone under 18.

11Changes

Posted here with the date; a change that matters is emailed first.