Privacy Policy
Last updated 18 October 2026
APIGate ("we", "us") runs APIGate. This page explains what we collect, why, who we share it with, how long we keep it, and the choices you have. In short: we keep what we need to run your account and show your usage, and we do not store the content of your AI requests or answers.
What we collect
| Information | Details | Why |
|---|---|---|
| Account | Name, email, a one-way fingerprint of your password (never the password itself), the plan you chose, and the Google or GitHub identity if you sign in with them | To create and secure your account |
| Sign-in sessions | For each signed-in browser: a random session code, the browser name, the IP address and the time | To keep you signed in and let you see and end your sessions |
| Provider keys | The keys you add for AI providers, stored encrypted (with a key kept in AWS Key Management Service); they are never shown again, not even to you | To forward your own calls to your providers |
| Your setup | Project and key names, key limits and locks, provider names and addresses, prices you set | To run the service for you |
| Usage records | For each call: the time, which key and provider, the model, the number of tokens, characters, seconds or pages, the estimated cost, the status, the time it took and the caller's IP address. Streaming sessions are recorded the same way | To show you usage and cost, to enforce your plan and key limits, and to find errors and abuse |
| Notices and requests | Notices we show you in the app, and any provider you ask us to support | To tell you about your keys and providers |
| Messages to us | What you send when you contact us | To reply and keep a record |
What we do not store: the text, images or audio you send to a provider, and the provider's answers. They pass through APIGate to be forwarded and are not kept. When a reply from a provider you added yourself cannot be read yet, we keep a stripped copy that holds only numbers and the model name (never the text) for up to 30 days, so your usage can be counted correctly once APIGate can read it. Provider error messages may be shown to you and kept with the failed call.
How we use it
- To provide APIGate: sign you in, forward your calls, count usage and estimate cost, enforce limits.
- To keep the service safe: detect abuse, a leaked key or unusual volume, and to find and fix errors.
- To contact you about the service, such as a password reset or a warning about one of your keys.
- To meet legal duties and to handle disputes.
We do not sell your information and we do not use it for advertising.
Who else handles it
- The AI providers you choose. Your calls go to them with your key. What they do with your content is covered by their own terms and privacy policies, not this one.
- Hosting. The app and its database run on servers rented from our hosting provider (Contabo), managed with Coolify.
- Amazon Web Services (Key Management Service) holds the root key that protects your provider keys.
- Resend sends our emails (for example a password reset).
- Google or GitHub, only if you choose to sign in with them.
We may also share information when the law requires it, or to protect the service and its customers.
How long we keep it
- Account, setup and usage records: until you delete your account (there is no automatic deletion of old usage records yet).
- Sign-in sessions: 14 days, or until you sign out; an expired session is deleted the next night.
- Password-reset links: valid for 1 hour; a used or expired link is deleted the next night.
- Stripped copies of unreadable replies: up to 30 days.
- Backups: daily backups are kept for 14 days, so data you delete can remain in a backup for up to 14 days.
- Records of actions our staff take on accounts (for example a plan change) are kept for security and accountability; after you delete your account they no longer contain your email.
Your choices and rights
- See and download your data: My account > Your data > Download my data.
- Delete your account and data: My account > Your data > Delete my account.
- Correct your name on the My account page; to change your email, contact us.
- Sessions: you can sign out any session on the My account page.
- For any other request about your information, including objecting to how it is used, contact us. Depending on where you live you may also have the right to complain to your data protection authority.
Security
Provider keys are encrypted; passwords are stored only as one-way fingerprints; APIGate keys are stored only as fingerprints and shown to you once; connections use HTTPS; and access to the admin area is limited and logged. No system is perfectly secure, so keep your own keys and password safe too.
Cookies
We use only the cookies the service needs. See the Cookie Notice.
Children
APIGate is for people who are old enough to enter a contract. It is not meant for children.
Changes and contact
We may update this policy; the date at the top shows the latest version, and we will tell you in the app or by email about changes that matter. Questions or requests: Contact.
