Privacy Policy

Last updated: April 5, 2026

What we collect

• Email address - when you register for an API key via POST /api/keys. Used to deliver your key and for account recovery.
• API request metadata - ZIP codes queried, timestamps, anonymized IP addresses, user-agent strings. Used transiently for rate limiting and debugging.

What we don't collect

• We don't use cookies or tracking scripts
• We don't use third-party analytics (no Google Analytics, no Mixpanel)
• We don't sell or share your data with third parties
• We don't store your IP address in a way that's linked to your API key

How we use your data

• Email: API key delivery and account recovery only. We will never send marketing emails.
• Request logs: Aggregate statistics and debugging.

Data storage

• API keys and emails are stored in a PostgreSQL database hosted on Railway (US region).
• Audit logs are stored on the application server and auto-rotate. They are not backed up externally.
• No data is stored outside the United States.

Data deletion

Email [email protected] to request deletion of your account and all associated data. We will process requests within 7 days.

Third-party services

• Resend - transactional email delivery
• Railway - application and database hosting
• US Census Bureau - coordinate-to-ZCTA geocoding (for /api/lookup/by-coordinates)

Changes

We may update this policy. Changes will be posted on this page with an updated date.

Contact

[email protected]