Privacy policy

We do not collect any personal data. There is no sign-up, no account, no e-mail address, no password, no name — getting an API key asks for nothing and stores nothing about who you are. No advertising, no tracking cookies, no third-party analytics; every font and script is served from our own server.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR), to the (very limited) extent it applies, is Fengshui API, the operator of this website and API. Reach us through the contact form (topic "Privacy / personal data request").

2. Your API key

Getting a key on the API key page, or via POST /api/v2/api-keys, asks for nothing — no form, no e-mail, no password. What we store for each key: a one-way hash of it (the key itself is never stored, so we cannot recover a lost key for you), the first few characters (so it can be told apart from a future one), and the date it was issued. That hash cannot be reversed into the key and is not linked to any identity.

Purpose: authenticating requests and enforcing the 1000-per-hour quota. Retention: until you revoke the key yourself (on the API key page, or DELETE /api/v2/api-keys) — we do not otherwise delete or expire keys.

3. Contact form

The one place on this site that does ask for anything is the optional contact form, if you choose to use it: your name, e-mail address, topic and message.

• Purpose and legal basis: answering you — our legitimate interest (Art. 6(1)(f) GDPR) or steps you asked for (Art. 6(1)(b)).
• Retention: the message is delivered to our mailbox and not stored on the website or in any database; we delete it once the matter is closed, at the latest after 12 months.

4. Protection against abuse

To keep the free quota fair and the service available, we keep short-lived counters — keyed by your API key, or by IP address for requesting a new key and for the contact form — that expire after at most one hour. Legal basis: legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).

5. Server logs

Like every web server, ours records technical access data — IP address, time, requested URL (which can include values you enter into a calculator), status code and browser type — to operate the service and investigate errors and attacks. Kept for no longer than 14 days. Legal basis: Art. 6(1)(f) GDPR.

6. Calculations

Dates and other values you enter into the calculators or send to the API are used only to compute the result and are not stored, apart from the transient server logs above.

7. Usage statistics

We count how many times each page and API endpoint is used per day. These counters hold only a date, a page/endpoint name and a count — no IP address, no key, no cookie, no identifier of any kind, and no way to link a count back to a visit.

8. Cookies and browser storage

We set no cookies at all — there is no login, so none are needed. The API playground and the API-key page store the key you generate or paste in your browser's sessionStorage, for the current tab only; it is never sent to us except as the header of the API requests you make yourself.

9. Who receives data

We do not sell or share data. The contact form's message is processed only by the providers we need to deliver that one e-mail (hosting and e-mail delivery), under data processing agreements. If a provider processes data outside the European Economic Area, this happens only with appropriate safeguards such as the EU Standard Contractual Clauses.

10. Your rights

Since we do not hold an account or profile about you, there is normally nothing to access, correct or export — your API key's hash cannot be traced back to you at all, and you can delete it yourself at any time. If you wrote to us through the contact form, ask us to delete that message via the same contact form. You also have the right to lodge a complaint with a data protection supervisory authority — in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), or the authority of the country where you live.

11. Security

Connections are encrypted and API keys are stored only as one-way SHA-256 hashes; access to the servers is restricted.

12. Changes

If we ever change how we process data, we update this page and the date above.