Privacy

Last updated 19 October 2026.

What we store

• Your account: your email address, and either a password (stored only as a one-way hash) or the id of the Google account you sign in with.
• API keys: a fingerprint of each key you create. The full key is shown to you once and never stored.
• Usage: how many requests each of your keys made per day, per endpoint, and whether they succeeded. Not the content of your requests.
• Billing: your plan and its status. Card details go straight to Stripe; we never see or store them.

Why

To run your account: sign you in, check your plan, enforce rate limits and show you your usage. We don't sell your data, and we don't send marketing email.

Cookies

One cookie keeps you signed in. Google Analytics only runs if you click "Allow" on the banner; it counts visits to this website, not your API calls.

Who processes it

• Stripe for payments.
• Google for sign-in with Google, and for analytics if you allow it.
• Cloudflare, which every request passes through.
• netcup, where the servers run, in the EU.

How long

Account data and usage counts are kept while you have an account and deleted with it. Billing records are kept as long as the law requires.

Your rights

You can see your account, keys and usage in your dashboard at any time. To have your account and its data deleted, or for any other question about your data, use "Message us" in your dashboard.

The race data

The API serves race results that HYROX publishes publicly. If you are an athlete and want a result removed, ask HYROX to remove it from their published results.