Effective: February 21, 2026 | Last updated: February 21, 2026
| Data | Purpose | Retention |
|---|---|---|
| Email address | Account identity, billing, service alerts | Until account deletion |
| Name (optional) | Personalization | Until account deletion |
| Password hash | Authentication (bcrypt, never stored in plaintext) | Until account deletion |
| API usage counts | Rate limiting, billing | Rolling 30-day window |
| IP address (demo only) | Demo rate limiting | In-memory only, cleared on restart |
| Payment identifier | Payment processing | Until account deletion |
Your Dilithium3 and Kyber768 key pairs are generated server-side and stored in our database. Private keys are associated with your account and used only to process your API requests. We are working on client-side key generation and encrypted-at-rest storage.
We use a small number of third-party providers for payment processing, transactional email, and network infrastructure (TLS termination, DDoS protection). These providers receive only the minimum data necessary to perform their function. We do not sell, share, or transfer your data to anyone else.
Email [email protected] to:
We use bcrypt password hashing, constant-time comparisons, TLS in transit, and NIST-standardized cryptographic algorithms. API keys are hashed before storage.