Privacy policy
What okdata keeps about customers and visitors, and for how long: call records 30 days, page views 90 days, results 24 hours, key hashes only, Stripe, XorPay, Resend, no third-party trackers.
In plain words: we keep the little we need to run a prepaid API: your email address, hashes of your keys, your balance, your payments and a record of your calls. Call records are deleted after 30 days, page views after 90 days and stored results after 24 hours. We never see your card details. We count page views, time on page and clicks with our own code, with a city-level location estimated from the IP address, to see how people use okdata; the site has no advertising or third-party tracking scripts. The public data the API returns is about other people, and section 7 explains how we treat it and how to ask about it.
1. Who is responsible
The operator of okdata is responsible for the personal information described here.
Operator (运营方信息): TODO: the legal entity and its registered address will be named here once finalised. Until then, write to hello@okdata.online for anything in this policy.
2. What we keep about customers
| What | Why | How long |
|---|---|---|
| Email address, chosen language, alert settings | Signing in with a one-time code, receipts, low-balance and service emails | While the account exists |
| Sign-in sessions: a hash of the session token, IP address, browser user agent | Keeping you signed in, spotting stolen sessions | Until you sign out, or 30 days |
| API keys: a SHA-256 hash, the first characters, name, created and last-used time | Checking keys; the key itself is shown once and never stored | Until you delete the key or the account |
| Balance, top-ups, trial grant | Billing, accounting, preventing trial abuse | As long as accounting law requires |
| Call records: time, key, endpoint, parameters, result status, charge, request ID | Your call log, billing questions, abuse prevention | 30 days |
| Stored results of calls | Returning the same answer for a retried request (Idempotency-Key) or a later lookup of the same call |
24 hours |
| Where you first came from (a source tag, the referring site, the landing page) | Knowing which pages bring people to okdata | While the account exists |
| The pages you viewed on the site and in the console (see section 3), joined to your account when you sign in | Understanding how people use okdata, so we can improve it | 90 days |
| Network address at sign-up | Limiting trial credit to a few accounts per network per day | Kept with the trial record |
Database backups are kept for 14 days and then overwritten, so deleted data can remain in a backup for up to that long.
3. What we keep about visitors
- No advertising or third-party trackers. The site loads no third-party scripts, ads or tracking pixels, and its fonts are served from our own domain.
- Page views and what you do on them, counted by us. A small script of our own (
/js/pv.js) records each page you open on the site and in the console: the path, the page title, the outside page that sent you, your browser language, screen width and time zone, and a random visitor ID kept in your browser's local storage (okd_vid). When you leave a page it records how long the page was in front and how far down you scrolled. It also records clicks on our own buttons (such as Start free or copying code), what you search for on the site, how free-tool and Try it runs went, and the address of other sites you follow links to. When a page view arrives, the server estimates an approximate location from the IP address at that moment (country, province, city and network operator, from an offline IP database) and keeps only that estimate, not the IP address, in these records; it also reads the device type, system and browser from the user agent. All of this goes only to https://api.okdata.online, never to a third-party analytics service. When you sign in, that browser's earlier records are joined to your account, so we can see how people find and use okdata. Nothing is recorded when your browser sends Global Privacy Control, or when local storage is blocked. These records are deleted after 90 days. - Server logs. Our web and API servers log each request (time, path, status, IP address, user agent, referring page). We use them for security, abuse prevention and to count visits by search and AI crawlers. Log files are rotated by size and overwritten as new traffic comes in.
- Browser storage. The console uses one cookie,
okd_session, to keep you signed in. The site stores your preferred code language tab, the first-visit source tag and the random visitor ID in your browser's local storage. The "Try it" panels keep a pasted key in session storage only if you ask them to, and send it only to https://api.okdata.online.
4. Who else handles it
We use a few service providers, each only for its part:
- Stripe processes card payments. Card details go to Stripe; we receive the payment result, amount and a reference.
- XorPay processes Alipay and WeChat Pay payments in Chinese yuan. We receive the payment result, amount and a reference.
- Resend delivers our emails (sign-in codes, receipts, alerts), so it receives your email address and the message.
- Google Cloud hosts our servers and database.
- Upstream data sources answer API calls. They receive the parameters of a call (a keyword, a link or an ID), never your email address, your key or your identity.
We do not sell personal information and do not share it for advertising.
5. Your choices and rights
You can see your keys, balance, payments and recent calls in the console, delete keys, change alert settings and sign out of every session. To get a copy of your data, correct it, or delete your account and its data, email hello@okdata.online from your account address. We answer within 30 days. Records the law requires us to keep, such as payment records, are kept for as long as it requires. If you are unhappy with how we handled a request, you can also complain to the data protection authority where you live.
6. Security
Keys and session tokens are stored only as hashes. Traffic to the site and the API is encrypted with HTTPS. Access to production systems is limited to the people who run the service.
7. Public data about other people
The API returns information that people chose to publish on public platforms: posts, comments, public profiles. We fetch it when a customer calls an endpoint. Apart from the 24-hour result store in section 2 and short-lived caches, we do not build a database of people or profiles, and we do not offer search by person beyond the public profile lookups described in the documentation.
If public content about you is returned by okdata and you want it removed, the most effective step is to delete or restrict it on the platform where it was published: once it is no longer public there, our endpoints stop returning it. You can also write to hello@okdata.online with the link; we will check our own stored copies and remove them, and tell you what we found. To report a customer misusing data, see the acceptable use policy.
8. Children
okdata is a service for businesses and developers and is not meant for children.
9. Changes
We may update this policy; the date at the bottom of the page shows the latest version. If a change materially affects how we use your information, we will tell you by email before it takes effect.
Updated