Privacy Policy

Last updated: October 6, 2026

The API is free and keyless. There are no accounts, no signup and no API keys, so we never ask for your name or email.

What we collect

• Request logs - IP address, user-agent, request path and query (for example the ZIP code you looked up), status code and timing. Our host, Railway, records these for every request, and our server writes a similar line to its own logs.
• Rate-limit counters - your IP address and a request count, held in memory for up to one hour to enforce the per-IP rate limit. They are never written to disk.

What we don't collect

• No accounts, emails or API keys
• No cookies or tracking scripts
• No third-party analytics (no Google Analytics, no Mixpanel)
• CSV files uploaded to /api/bulk are processed in memory and not stored
• We don't sell or share your data

How we use it

• Rate limiting, debugging, and aggregate usage statistics.

Data storage

• There is no database. Request logs are kept by Railway under its log-retention policy and are not backed up elsewhere.

Third-party services

• Cloudflare - DNS, TLS and request proxying
• Railway - application hosting and request logs
• US Census Bureau - coordinate-to-ZCTA geocoding (the coordinates you send to /api/lookup/by-coordinates are forwarded to it)

Questions or deletion requests

Email [email protected].

Changes

We may update this policy. Changes will be posted on this page with an updated date.

Contact

[email protected]