Locio privacy & data

An account keeps your email address, the handle you choose, and a hash of your password made with Argon2, never the password itself.

which includes the query, the caller's IP address and the time

For each API key we keep the number of lookups and units used per day, and when the key was last used.

Stripe takes the card and keeps the invoices; we never see the card.

The contact form sends us your name, email address and message as an email, together with the IP address it came from

tells us which country a request came from, which decides the country a public key searches. We do not store that country.

we count how many lookups each key makes each day, because that is what the plan and the invoice are made of.

so we can deal with abuse

a lookup that takes too long is logged with its query so we can make it faster.

Server logs are kept for at most 30 days and then deleted.

Your account, keys, daily usage counts and agent connections: until you delete the account.

Invoices: kept by Stripe for as long as the law requires, because they are tax records.

Contact form messages: as long as it takes to deal with them.

locio_session keeps you signed in, for up to 90 days.

DigitalOcean runs our servers and database, in Sydney.

Some of these process data outside Australia, including in the United States.

Some of these process data outside Australia, including in the United States.

Cloudflare sits in front of the site and the API, so every request passes through it and it sees your IP address.

Delete it yourself from /account/delete .

You can ask us for a copy of what we hold about you, to correct it, to delete it, or to stop using it.

you can complain to the Office of the Australian Information Commissioner at oaic.gov.au

we never sell or share what we keep for anyone else's use