API Hub

Privacy Policy

Last updated 19 October 2026

This policy explains what personal data API Hub collects when you use this website and its API, why, who we share it with, and your rights. API Hub is run by Sam Smith Codes ("we", "us"), the controller of this data under UK data protection law (the UK GDPR and the Data Protection Act 2018).

What we collect

  • Your account: your name and email address, your password (stored scrambled, as a hash, so we can't read it), and, if you set them up, your passkeys (named by you, e.g. "MacBook") and two-factor authentication details. Also your account's plan, any limits we've set for it, and the timezone you choose to see dates and times in.
  • Your API keys: each key's name, which APIs it can use, when it expires, and when it was last used. We only keep a hash of the key itself.
  • How you use the API: for each request made to the API, the address requested, which includes what you looked up (such as the IP address or domain name), which key it was made with, the IP address it came from and roughly where that address is (the country and city, worked out from the address), whether it worked, and when, and a daily total of requests for each key and endpoint. You can see each request made with your keys on your API requests page. Requests without a valid API key are kept the same way, without being linked to an account.
  • Where your API keys are used from: for each key, the IP addresses it was used from each day, roughly where each address is (the country and city, worked out from the address), how many requests came from it, and when the last one was. You can see these on your API keys page, to spot a key being used somewhere it shouldn't be.
  • Logging in: while you're logged in, your IP address and browser details (its "user agent"), to keep your session secure.
  • A security log: a record of logins, failed logins (with the email address typed), logging out, and changes to your account, such as your email address, password, two-factor authentication, passkeys and API keys. Each entry has when it happened, the IP address and browser details it came from, roughly where that address is (the country and city), and, if one of our admins made the change, which admin.
  • Server logs: for each page and API request, your IP address, the address requested, when, whether it worked (the response code), how long it took, the page you came from, your browser details, and your account number if you're logged in or using an API key. Like most websites, we keep these to keep the service running and secure, and to look into problems and misuse.
  • Errors and performance: when something goes wrong, or a request is slow, we keep details of that request, which can include what was looked up and your IP address, to find and fix the problem.
  • Emails: the emails we send you, such as verifying your email address and resetting your password, security alerts when someone logs in to your account, or uses one of your API keys, from a country it hasn't been used from before, and reminders when one of your API keys is about to expire.

Why we use it

  • To provide the service: your account, API keys and the lookups you ask for. This is needed for our agreement with you (our Terms of Service).
  • To keep it secure and fair: protecting accounts, stopping abuse and bots, and applying rate limits. The security log, where your API keys are used from, and the emails about new countries let you and us spot logins and key use you don't recognise, and look into misuse of an account or the service, and the server logs let us look into problems and attacks. This is in our legitimate interests, and yours.
  • To run and improve it: usage reports, and finding and fixing errors. This is in our legitimate interests.
  • To contact you about your account and changes to these policies.

We don't sell your data, use it for advertising, or make automated decisions about you.

Who we share it with

  • Cloudflare checks that it's a person, not a bot, filling in the login, sign-up and forgot password forms (Turnstile), which uses your IP address and browser details. DNS lookups you make through the API are sent to Cloudflare's DNS to answer them.
  • Mailgun sends our emails, so it handles your email address and the emails we send you.
  • Have I Been Pwned checks whether a new password has appeared in a data breach. Only the first five characters of a scrambled (hashed) version of it are sent, never the password itself.
  • Our hosting provider runs the servers the service and its data are on.
  • The authorities, if the law requires it.

To look up where an IP address is, we use MaxMind's GeoLite2 data on our own servers, so those lookups aren't sent to MaxMind. Likewise, our admins search accounts and the security log with Meilisearch, a search engine running on our own servers, so that data isn't sent anywhere else.

Some of these providers may handle data outside the UK. Where they do, we rely on the safeguards UK law requires, such as the UK's adequacy regulations or standard contract clauses.

How long we keep it

  • Your account and API keys: until you delete your account. It's deactivated straight away, so you're logged out and your API keys stop working, and deleted for good 31 days later. If you log back in before then, or ask us to restore it, it's reactivated.
  • The security log: for 365 days, then deleted. It's kept for that time even after you delete your account, as we may need it to look into misuse of an account or the service.
  • Where your API keys are used from: for 31 days, the same as each request. Deleted straight away, rather than made anonymous, when the key is deleted or your account is deleted for good.
  • API usage records: each request is kept for 31 days, and the daily totals indefinitely. When a key is deleted, or an account is deleted for good, its records and totals are made anonymous straight away, so they're no longer linked to it, and kept for the same time. When an account is deleted for good, the IP addresses (with where they were) and addresses requested (with what was looked up) are also removed from its requests.
  • Rate limit and quota counts: how many requests you've made this minute to each endpoint, and this month in total, until the minute or month ends. Without an API key, the per-minute counts are kept against a scrambled (hashed) version of your IP address.
  • Server logs: for 14 days, then deleted.
  • Login sessions: until you log out (or log them out from your Security page), or two hours after your last visit (longer if you tick "Remember me").
  • Error details: 48 hours. Performance details: 7 days.

Cookies

We only use cookies the site needs to work: one to keep you logged in (and to remember you, if you ask), and one to protect forms against forgery. We don't use analytics or advertising cookies. Your light or dark theme choice is saved in your browser, not sent to us.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, to object to how we use it, or to have it in a form you can take elsewhere. You can change your name, email address and password, or delete your account, yourself on your account page, and see your recent activity from the security log, and where you're logged in, on your Security page. For anything else, email hello@samsmith.codes, and we'll reply within a month.

If you ask us to delete your data, we'll delete your account for good straight away, without waiting the 31 days, but keep the security log for the time above, as we need it to protect accounts and the service.

If you're unhappy with how we've handled your data, please tell us. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Changes to this policy

We may update this policy, for example when we change what we collect or who we share it with. When we do, we'll change the date at the top of this page. If the changes are significant, we'll also tell you by email.

Contact us

Questions about your data or this policy? Email us at hello@samsmith.codes.