We keep no database. API keys are signed tokens that you hold; we do not store them.
A free key contains a SHA-256 hash of the email you signed up with (not the address). We do not send you email.
A paid key contains your Stripe subscription ID, so we can check your plan with Stripe when you refresh it. Stripe handles your card; we never see card numbers.
To enforce rate limits, each server instance briefly keeps per-key request counts in memory, and for the keyless demo and free-key signups a salted hash of your IP address with a daily count. These are not written to disk and disappear when the instance restarts.
What we do not store
The descriptors you send are processed in memory and not saved or logged by us. We do not sell data, use ads or tracking cookies.
Processors
Cloudflare (hosting) and Stripe (payments) process data on our behalf under their own terms. Cloudflare may keep short-lived request logs (such as IP address and URL) for operating and securing the service. The keyless demo sends the descriptor in the URL (/v1/demo?q=...), so it can appear in those logs; use a key and POST /v1/clean for anything private.
Deleting
We hold no per-user records to delete. Stripe keeps billing records under its own terms; email us with questions.