Privacy policy
This service is run by tamago, a sole-trader brand. The sole trader behind it is responsible for the personal data described here. Write to support@tamagoapi.com about any of it.
What we hold, and why
Sign-in to the website is not live yet. Today, email is the only way to reach us and to ask for access.
- Your email address and what you write to us, to answer you, and to decide on a request for access.
- Your Discord user ID and your sign-in ID, once sign-in opens, to know who you are when you sign in, and to tie your account to you.
- Your API keys, stored only as a salted hash and a short prefix, to check a key on every call without keeping the key itself.
- A record of each API call: the endpoint, the result code, how long it took, a request ID and the time, to charge for successful calls and to show you your usage.
- Your balance, your spending and any spending caps you set, to run the prepaid balance.
- Each top-up: the amount, the pack and the payment processor's transaction reference, to credit your balance and show your receipts.
The challenge scripts you send and the payloads we return are used to answer the call. They are not stored with your account. Our servers also keep operational logs to run and fix the service. Each request line has a field for your account ID and one for the ID of the API key that made the call, never the key itself. Both fields hold a dash when the request carried no key we could identify. Other log lines can still name your account or a key. An error during something you do on the signed-in website can be logged with your account ID. When you manage a key, on the website or with the API, the request address we log can hold that key's ID, and so can an error line. When a payment provider confirms your top-up, that notice is logged with your account ID. A log line can also include the address of the page a call was for.
Who else handles it
- Discord and Clerk, for sign-in, once it opens. Clerk will confirm your Discord identity and whether you are in the tamago Discord server. Neither handles your data today.
- Paddle, which sells top-ups paid through Paddle as Merchant of Record. Paddle collects your payment and billing details under its own privacy policy. We never see your card.
- Stripe, only if you choose to pay with Stripe instead. Stripe processes that payment for us and is not the Merchant of Record. Stripe collects your card and billing details on its own page, under its own privacy policy. We never see your card.
- Our hosting and email providers, which run the website, the API and the support mailbox.
We do not sell personal data, and we do not use it for advertising.
Cookies
The website sets two cookies, both needed for sign-in once it opens: __session keeps you signed in, and tamago_return remembers which page to return you to after signing in. There are no analytics or advertising cookies.
How long we keep it
While your account is open, and afterwards for as long as the law requires us to keep billing records.
Your choices
You can ask for a copy of your data, for a correction, or for your account and its data to be deleted. Write to support@tamagoapi.com. Depending on where you live, you may also complain to your data protection authority.