Privacy policy

This policy explains what Awesome Factory LLP, 7 Coronation Road, Dephna House, Launchese (“we”) collects when you use Simple Numerology API (the website and the HTTP API), why, and what you can do about it. Questions go to privacy@simplenumerologyapi.com.

What we store

• Your email address, to identify your account, send verification codes and password-reset codes, and send notices about your account (security changes to your keys and password, quota warnings, billing problems).
• Your password, only as a salted one-way hash (Argon2id); we cannot read it back.
• GitHub or Google, if you sign in with one: your account id there and the profile it sends us (for GitHub, your public profile and email addresses; for Google, your email address). We ask for nothing else and keep no access to your account there. Disconnect it from the dashboard at any time.
• API key metadata: a name you choose, its mode, when it was created and last used. The key itself is stored only as a one-way SHA-256 hash; we cannot read it back.
• Usage counters: how many requests your account made this period, and each day per endpoint. Not what they contained.
• Billing references: your Stripe customer and subscription ids. Card details go directly to Stripe and never reach our servers.
• Sessions: while you are signed in to the dashboard, a session record with the IP address and browser it was opened from, so that you can see your sessions and end the ones you do not recognise. It is deleted when the session ends.

What we do not store

Chart inputs and results are not stored. The names and birthdates you send to the API are processed in memory to compute the response and then discarded. They are not written to our database or to our logs, and error reports sent to our error tracker have request bodies removed. We do not log IP addresses in our application logs. Apart from your open dashboard sessions (above), the only place one is kept is the rate limiter, which keeps a client address for at most an hour to enforce limits on unauthenticated endpoints.

Website analytics

We count visits to the website (not calls to the API) with our own, cookieless analytics. For each page you view we record the page’s path, the site that referred you and any campaign tags in the link, your country, region and city, your device type, browser, operating system and language, how long the page was visible, and a few actions such as following an outside link or starting checkout.

No cookie is set and nothing is stored in your browser. Your IP address is not stored: it is looked up in a geolocation database kept on our own servers (no address is sent to anyone) and only the place is kept. To count unique visitors without a cookie, your visits are grouped by a hash of your IP address, your browser’s user agent and a random value that we replace, and delete, every day. Visits on different days cannot be linked, and once a day’s value is deleted the hash can no longer be traced back to an address. Visits from signed-in staff and from automated clients are not counted.

The home page demo

The demo on the home page is protected from automated abuse by Cloudflare Turnstile, which the page loads from Cloudflare. When you start using the demo (typing in it, or pointing at or focusing Calculate), and again after each chart it shows you, Turnstile runs in your browser and sends Cloudflare technical signals about it, such as your IP address and browser characteristics, to tell people from bots. The names and date you type go only to us and are not stored, like any other chart input. Cloudflare processes these signals under its Turnstile privacy addendum.

Why, and on what basis

We process account data to provide the service you signed up for (performance of a contract), to keep it secure, prevent abuse and understand how the website is used (legitimate interests), and to keep invoices as tax law requires (legal obligation). We do not sell data, show advertising, or use tracking pixels in email.

Who processes it for us

Processor	Purpose	Location
Stripe	Payments, subscriptions, invoices and tax	United States / Ireland
Resend	Transactional and support email	United States
OVH Groupe SA�	Application servers and database	As configured for the service
Cloudflare	Turnstile, the bot check on the home page demo (not the API)	United States
Google Fonts	Web fonts on the website (not the API)	United States
Sentry	Error reports, with request bodies and headers removed	United States

Transfers outside the EEA and UK rely on the processors' Standard Contractual Clauses.

How long we keep it

• Account data: until you delete the account. Daily request counts are then kept without any link to you, as totals for the service.
• Unverified signups: deleted after 7 days.
• Website analytics: the value that links a day’s visits is deleted after that day; the records of pages viewed, which then hold no identifier, are kept to compare trends over time.
• Verification and password-reset codes: expire after 15 minutes; sessions after 14 days.
• Invoices and payment records: kept by Stripe for the period accounting law requires, even after account deletion.

Your rights

You can download everything we hold about your account and delete the account yourself from the account page. Deletion stops any subscription renewing and removes the account, its keys and its sessions immediately. You can also ask us for access, correction, restriction or erasure, or object to processing, at privacy@simplenumerologyapi.com, and you may complain to your data protection authority.

Customers who send us their users’ data

If you send your own users’ names and birthdates to the API, you are the controller of that data and we process it on your behalf under our data processing terms.

Cookies

The dashboard sets two strictly necessary cookies: sn_session, to keep you signed in, and csrftoken, which protects your account from cross-site requests. The documentation page remembers your preferred code language in your browser’s local storage, and the sign-in page remembers how you last signed in (password, GitHub or Google) there too, to point it out next time. Neither holds anything about your account. There are no analytics or advertising cookies: the website analytics described above use none.

When you start a subscription, the account page loads Stripe’s payment form (Stripe.js) from Stripe at that moment, and not before. Stripe then sets its own cookies (__stripe_mid and __stripe_sid) to prevent fraud, as described in Stripe’s cookie policy.