Privacy
We collect the email you log in with, session cookies, and usage counts. We do not run GA4 and we do not sell that data.
Effective 25 August 2026. Operator: AQX LLC. Contact operations@aqx.llc.
What we collect
| Item | Why |
|---|---|
| Email, OAuth subject (GitHub or Google) | Account, magic link, identity linking |
| API key hashes, prefixes, last used | Auth. The raw secret is shown once and not stored |
| Plan, Stripe customer id, attestation time | Billing |
| Request counts by HTTP status, UTC month | Usage. Not full request logs after account delete |
First-party events on POST /t | Which page and CTA led to checkout. No raw IP in that table |
Cookies
| Name | What it does |
|---|---|
pit_session | HttpOnly session, SameSite=Lax, 14 days |
pit_csrf | Non-HttpOnly copy of the CSRF token, sent back in X-CSRF-Token on cookie POSTs |
pit_oauth | Short-lived PKCE state during GitHub/Google |
pit_aid | HttpOnly anonymous id for /t, one year |
All four are first-party and none of them carries advertising, so the site shows no consent banner.
Who we share with
Processors that run the product: Google Cloud (hosting, objects, database), Stripe (checkout and portal), GitHub and Google (OAuth), and the email vendor that sends magic links. Named list: subprocessors. We do not sell personal data.
Retention
Account rows last until you delete the account or we close it. Magic links expire in 15 minutes and are single-use. Invoices and usage aggregates outlive a deleted account because tax law requires us to keep them. Commercial DPA on request.
Delete
Dashboard → delete account, or DELETE /v1/me with a session. Deletion takes effect on the request: the account’s keys are revoked in the same step and the email becomes reusable straight away.
Samples
The public playground does not need an account. Sample calls are IP rate-limited. They are not tied to your email unless you are also logged in.
Contact
operations@aqx.llc. Related: terms, security.