Privacy

1What we keep

• Your account: your email address, your plan, what you told us you would use the API for, and the id Google gives your account.
• Your API keys: only a fingerprint of each key and its first few characters, never the key itself, with the labels you give them.
• Usage counts: calls a day for each key, and for each endpoint.
• Refused calls: when a call is refused, which endpoint, why and when, so your dashboard can show it.
• MCP tool calls: which tool was called, when and the answer code. Never what you asked your assistant.
• Support tickets: what you write to us and our answers, held in Developer Data's support system.
• Page and security logs: pages visited, sign-ins, and the network details that come with every request.

2Card details

We never hold card details. Stripe takes the payment and keeps the card.

3Why we keep it

To run the API and your account, bill your plan, answer support, stop abuse and keep the service secure. Nothing is sold, and there is no advertising tracking.

4Who else handles it

• Stripe: payments, when you choose a paid plan.
• Cloudflare: the network in front of the website and the API, and its security.
• Our email provider, through Developer Data: the emails we send you.
• Google: signing in with your Google account. When you sign in, Google shares your name, email address and profile picture with Developer Data; we keep only your email address and the id Google gives your account, never your name or picture. While you are signed out, our pages load Google's sign-in script so the sign-in pop-up and button can appear, which means Google receives your IP address and may use its own cookies.
• Our hosting company: the servers the service runs on.

5Cookies

• tt_s: keeps you signed in, for up to 30 days.
• tt_oauth: ties Google's answer to your browser while you sign in, for 10 minutes.
• tt_newkey: shows a new key to you once, for 5 minutes.
• tt_flash: carries a short message to the next page, for 2 minutes.
• tt_ot: a random value that protects signing in with Google's pop-up or button, for 10 minutes.
• tt_out: notes that you have just signed out, so Google's pop-up does not open again at once, for 1 minute.

There are no analytics or advertising cookies.

6How long we keep it

• Your account and what you put in: while the account is open.
• After you delete your account: gone within 30 days, backups included.
• Billing records (invoices, payments): as long as tax and accounting law requires, even after the account is deleted.
• Page, API and security logs, refused calls and MCP tool calls: 30 days. Sign-in records: 7 days.
• Support tickets: while the account is open, then deleted with it.

7Your rights

You can ask to see what we hold about you, have it corrected, take a copy, or have it deleted. Ask through support; we answer within 30 days.

8Deleting your account

You can delete your account yourself on your dashboard, under plan and billing: Delete my account. You are shown what happens and tick a box before it goes ahead. Then:

• any paid plan is cancelled at once, and the unused part is not refunded;
• every API key and MCP address stops working at once;
• you are signed out;
• your account and what you put in are deleted within 30 days;
• billing records stay as the law requires, tied to the payment record, not to an account.

If you cannot sign in, ask through support and we will delete it for you.

9Children

Table Tennis API is not for anyone under 18.

10Changes

A new version is posted here with its date. A change that matters is emailed to members before it applies.