Privacy Policy

What we collect

You give us some information directly:

• Account information: your owner name, your display name, your email address, and a password. We store the password only in hashed form.
• Organizations: the organizations you create or join, their names, and your role in each.
• API keys: the name you give each key and its first few characters. We store the key itself only in hashed form.
• Correspondence: whatever you include when you email us.

Some is recorded when you call the API:

• Usage records: for each call that uses a credit, the endpoint, the time, the result, how long it took, and the key that made it. For AI APIs they also hold the model and the number of tokens. If you send a request ID, it is recorded too. Usage records do not include what you send in the request.
• Cached responses: if you send the Sfaie-Cache header, we store the response so that a later request can reuse it.

A small amount is collected automatically:

• Server logs: standard request logs, including your IP address, browser type, and the addresses you requested.
• Session data: if you sign in, a session cookie plus the session's IP address and browser type.
• Active organization: a cookie that remembers which organization you last chose, for up to a year.
• Analytics: Google Analytics counts visits and which pages are read. It sets cookies in your browser and sends Google your IP address, browser type, and the pages you visit.

Google explains how it uses this information on its page How Google uses information from sites or apps that use our services.

What we do not collect

We run no advertising pixels or session-replay tools. We do not buy data about you from anyone. The site takes no payments and holds no card details.

When you try an API on the site, your browser keeps the key you chose for that tab only. It leaves your browser only as part of the API call.

How we use information

• To run your account, your organizations, and your API keys.
• To answer your API calls, count the credits they use, and show you your usage.
• To respond to your messages.
• To operate, secure, and debug the site and the API.
• To comply with law.

When we share information

We do not sell personal information, and we do not share it for advertising. We share it only as follows:

• Public profiles: an owner page shows its owner name and display name to anyone, unless a member makes it private in settings. Your personal owner page starts public.
• Infrastructure: the site, the API, and their database run on Google Cloud in the United States, so information you submit is stored there.
• Data providers: to answer a call to a data API, we send its parameters, such as a username or a ticker, to the provider that supplies the data. We do not send your account details.
• Anthropic: a call to the anthropic/claude API sends the content of your request to Anthropic, which returns the model's reply.
• Email: mail you send us is forwarded by Cloudflare Email Routing and stored in Gmail, where we read it. Our replies are delivered by Postmark. Each of these services processes your email address and your message in order to deliver it.
• Fonts: pages load their typefaces from Google Fonts, so your browser sends Google a standard web request, including your IP address. Google Fonts sets no cookies.
• Analytics: Google Analytics processes the visit data described above on our behalf.
• Legal reasons: we may disclose information when the law requires it, or to protect our rights, our users, or the public.
• Business transfers: if SFAIE is part of a merger, acquisition, or asset sale, information may transfer with it and remains covered by this policy.

How long we keep it

We keep account, organization, key, and usage information while the account exists. When an organization is deleted, we keep its record so that no one else can claim its name. A cached response is kept for up to thirty days after the request that stored it. Server logs rotate on our infrastructure provider's standard schedule. Google Analytics deletes the visit data it collects here after two months. Its reports keep only totals, such as page views per day, which identify no one.

Your choices and rights

You can make your owner page private in settings. You can ask what information we hold about you, ask us to correct it, or ask us to delete it.

Depending on where you live, some of these choices are also legal rights. We honor the requests for everyone, wherever you live, and we do not discriminate against you for making them.

Some browsers can send a Do Not Track signal. The site does not respond to it. Google Analytics here uses cookies set for this site alone, and its features that link visits across sites and devices are turned off.

Security

We use reasonable administrative and technical safeguards, including encryption in transit and hashed storage of passwords and API keys. No internet service is perfectly secure, and we cannot guarantee absolute security.

Children

The site is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has given us personal information, contact us and we will delete it.

Visitors from outside the United States

We operate from the United States, and information is processed and stored there. Using the site or the API from elsewhere sends your information to the United States.

Changes to this policy

We may update this policy. When we do, we change the date at the top of this page, and we announce material changes on the site or by email.

Contact

Requests and questions about your information can go to our email.