Privacy policy

This is the previous version. It applies to accounts created before October 17, 2026 until November 16, 2026, when the current version takes over. Read the current version.

Last updated: October 14, 2026

What we collect

Your account. Your email address, name and a hashed password. We never see your password.

API and tool calls. For every call, from your code or from an AI app you connected: the tool and the arguments sent to it, the time, the credits charged, how it went, the IP address and the user agent. We use this to bill credits, answer support questions and stop abuse. We receive only what the app sends to our tools, never your conversations with it.

Connected apps. When you connect an AI app (Claude, ChatGPT or another MCP client) by signing in, we store which app it is, what you allowed it to do, when, and the tokens it uses to call EndzoneAPI for you.

Where you came from. When you sign up, we store the site that referred you, the first page you visited, any campaign tags on the link and the app that sent you, if any. We use it to learn which channels bring people.

Failed sign-ins and keys. We log failed authentication attempts (time, IP address, user agent, and a fingerprint of the key, never the key) to detect abuse.

We do not sell your data.

How we use it

To run the service: authenticate you and your apps, count credits, send transactional emails (verification, receipts, low-credit and account notices) and short onboarding emails after you sign up, and fix problems. We do not send unrelated marketing.

Who else handles it

Stripe processes payments (we never see your card). Resend delivers our emails. Vercel and Railway host the site and API, and Neon stores the database. Google Analytics measures site visits. Each acts on our behalf under its own privacy policy.

Cookies

A session cookie keeps you signed in. A first-party cookie remembers where you first came from, for the attribution above. Google Analytics sets its own cookies to count visits.

Keeping and deleting it

We keep account data, usage logs and connected-app records while your account is open. You can revoke API keys and disconnect connected apps at any time on your keys page; a disconnected app can no longer renew its access, and access it already has expires within an hour. To delete your account and its data, email support@endzoneapi.com from the account's address.

Contact

Questions about this policy: support@endzoneapi.com. Help with anything else: support.