Privacy

Privacy Policy

Last updated: September 28, 2026 · Controller: Jaeyoung, an individual · Terms of service

This policy explains what personal data webscrapingapi.dev ("the service") collects, why, how long it is kept, where it is stored and what you can do about it. It is written to satisfy the Personal Information Protection Act of the Republic of Korea, where the operator is based, and to be clear to users elsewhere. The short version: the service keeps your account details, a 30-day log of your requests without the pages themselves, the jobs you run and their results for 30 days, and what you post on the board. A page you fetch is stored only when you run it as a job or ask for a shared result (max_age). It runs no advertising and sells nothing.

1. Who is responsible

The data controller and the person in charge of personal data protection is Jaeyoung, the individual who builds and runs the service. Contact: help@webscrapingapi.dev.

2. What is collected, why, and for how long

Data	Purpose	Kept
Account: email address, display name, sign-in provider (Google or email/password) and the identifier Firebase Authentication assigns. Passwords are handled by Firebase and never visible to the operator.	To sign you in, to tie keys and quotas to you, to email you when someone replies to your post or your site request changes status (you can turn this off in the dashboard), and to contact you about the service if necessary.	Until you delete your account or it is removed after twelve months without activity.
API keys: a hash of each key, its prefix, its name, when it was created and last used, and its request count. The key itself is shown once at creation and not stored.	To authenticate requests and let you manage your keys.	Until you revoke the key or delete your account.
Request log: for each API request, the target hostname (not the full URL or query string), the response status, timing, credits used, whether rendering was used, the error code if any, and which key and account made it.	To enforce quotas and rate limits, to show you your usage, to detect abuse and to fix broken endpoints.	30 days, then deleted automatically.
Jobs: the name you give a job, its targets (full URLs or site calls, with their options), each target's status, error code and credits, the endpoint it reports to and how the delivery went. A target sent with your own headers (for example cookies) is private: its headers wait encrypted in the job queue until it is fetched and are then discarded, never written to the database, and the page it returns is kept with that job alone and never shared.	To process the job, to let you follow it and read its results by id or in the dashboard, and to deliver them to your endpoint.	30 days, then deleted automatically. You can delete a job earlier; deleting your account deletes your jobs.
Shared results: for each target fetched by a job or by a request with max_age, the target (full URL or site call, with its options) and the result in the format that was asked for; for format=html that is the page's HTML. Results are kept per target, not per person, and are not linked to your account; a result fetched for a job records the job's id. Targets sent with your own headers are never among them.	So that anyone who asks for the same target with max_age, you or another user, gets the stored copy without a new fetch. Anyone who knows the exact target can receive it, so do not run jobs or use max_age on addresses that carry secrets such as signed links or tokens.	30 days after the target was last fetched, or until the job that reused it expires if that is later, then deleted automatically.
Endpoints: the https address you register for job results, its description, a signing secret and the time and status of the last delivery. The secret is shown to you once and kept so that deliveries can be signed.	To send you job results and let you check that they came from the service.	Until you delete the endpoint or your account.
Server logs kept by Google Cloud: for each request, the IP address, browser or client name, path, status and timing; for errors, the path and the error message. API requests whose address carries a query string (?url=, ?api_key=) are left out of these logs, and the service's own error logs never contain a query string.	To run the servers, find faults and detect abuse.	30 days, then deleted automatically.
Email verification codes for sign-up and password reset: the address, a hash of the code, and how many were sent. Emails are sent from help@webscrapingapi.dev through Resend (see section 4).	To confirm the address is yours before an account is created, and to stop abuse.	One hour after the last code, then deleted automatically.
Daily usage counters per account.	Quota enforcement.	Rolling; entries older than a few days are removed.
Board content: posts, comments, the site you request and its status, your display name shown next to them.	To run the board and build requested endpoints.	Until you delete them or the account is deleted. Public posts may remain visible in anonymised, summarised form if they document how an endpoint was built.

Legal basis: performance of the service you asked for (account, keys, logs, board), the operator's legitimate interest in keeping the service safe and within its cost limits (abuse detection), and your consent where the law requires it, which you give by creating an account.

3. What is not collected

• The pages you fetch with a plain request. Unless you run it as a job or pass max_age, the response body, full URL and query string are processed in memory and discarded; only the hostname is logged. Headers you send (for example cookies) are never written to the database or to logs, and a page fetched with them is never shared: a plain request uses them and drops them at once, and a job keeps them encrypted in its queue only until that target is fetched and keeps the page only as that job's result.
• Results from the site-specific endpoints are stored for up to 30 days so that other users asking for the same public page can be served without a new fetch. They are derived from public pages and are not linked to the user who requested them.
• No advertising or tracking cookies. Visit statistics come from Cloudflare Web Analytics, which counts page views, referrers, countries and page-speed timings without cookies, local storage or fingerprinting; nothing in it identifies you. This website sets no cookies and uses no browser storage at all; there is no sign-in here. Signing in exists only in the dashboard (app.webscrapingapi.dev), where Firebase Authentication keeps your session.
• No payment data. The service is free and takes no payments.

4. Who else sees the data

• Processors. The service runs on Google Cloud and Firebase (Google LLC), which store the data on the operator's behalf: authentication, the database, the request log and the servers. Verification and notification emails are delivered by Resend (Resend, Inc., USA), which sees the recipient address and the message. Cloudflare, Inc. (USA) provides DNS, forwards mail sent to help@webscrapingapi.dev, and runs the cookie-free visit statistics. All three act under their own data processing terms and do not use the data for their own purposes.
• No sale, no sharing for marketing. Personal data is not sold, rented or shared with advertisers or data brokers.
• Legal requests. Data may be disclosed if the law requires it or to protect the service or others from harm, and only to the extent necessary.
• Public board. Anything you post publicly is, by design, visible to everyone and may be read by search engines and AI crawlers, which this site explicitly allows.

5. Where the data is stored (international transfer)

The data listed above is stored and processed in Google Cloud data centres in the United States (region us-central1) by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. It is transferred there over encrypted connections at the moment you sign in or make a request, for the purposes and periods in section 2. Google is bound by its Cloud data processing terms and standard contractual clauses. If you do not want your data transferred to the United States, do not use the service; there is no alternative region.

6. Your rights and how to use them

• See and correct. Your account details, keys and usage are visible in the dashboard.
• Revoke keys and delete posts yourself, at any time, in the dashboard.
• Delete your account yourself in the dashboard (Account → Delete account). Your keys, endpoints, unfinished jobs, usage counters, board posts and comments and your sign-in account are removed immediately; finished jobs and request-log entries are removed at the same time or, if there are too many to finish at once, expire on their own within 30 days. If you cannot sign in, contact the operator (section 1) from the email address on the account and it is done within 14 days.
• Object or restrict. You can ask the operator to stop or limit processing, or withdraw consent, with the same contact. Withdrawing consent ends your use of the service.
• Complain. Residents of Korea can contact the Personal Information Protection Commission (privacy.go.kr, 182). Residents of the EEA or the UK can contact their local supervisory authority.

7. Children

The service is not directed at children. You must be at least 14 years old to create an account. If an account belonging to a younger child comes to the operator's attention, it is deleted.

8. Security

All traffic is encrypted in transit. API keys are stored only as hashes, so a database leak would not reveal them. Endpoint signing secrets are stored as they are, because the service needs them to sign deliveries, and are readable only through the API. Access to the production project is limited to the operator with two-factor authentication. No system is perfectly secure; if a breach affecting your data is discovered, you will be told without undue delay.

9. Changes to this policy

Changes are published on this page with a new "last updated" date. Changes that expand what is collected or how it is used take effect only after being shown here for at least seven days.