Privacy

What we store

• Your account. Your email address, and your name if you sign in with Google. We use them to sign you in and to email you about your account.
• API keys. A one-way hash of each key and its first few characters, so we can check requests without keeping the key itself.
• Connected apps. When you connect Claude, ChatGPT or another app, you sign in here and we create an API key for it, named after the app. The app keeps that key; revoke it in your dashboard to disconnect.
• Usage counts. For each account, per day and per endpoint: how many requests, how many credits and how many errors. They power billing, limits and your dashboard.
• Request log. For each call: when, which endpoint, its parameters (never your key), which of your keys or apps made it, the result code, credits and how long it took, and what it returned (the response, up to its first megabyte), so you can open any recent call in your dashboard. We keep it for 14 days to answer support questions and stop abuse, then delete it. Your account keeps its first request from a key or an app (when, which endpoint, its parameters), so we know what people come to LurkAPI for.
• Free tries without an account. We count requests per IP address per day to enforce the free limit, and use Cloudflare Turnstile to check you’re not a bot. The request log records each try with its IP address, but not what it returned. A request Claude Code makes before you sign in is logged the same way; if you then sign in from Claude Code on that address within the hour, it becomes your account’s first request.
• Purchases. Stripe runs checkout. We receive a record of each purchase (amount, credits, date), never your card number.
• Cookies. One sign-in cookie, set only when you log in, plus the analytics cookies below. No advertising cookies.

What we fetch

When you make a request, LurkAPI fetches publicly available pages from the platform you asked about. We don’t log in to anyone’s account and don’t access private content. Responses may be cached briefly to make repeat requests faster; the cache isn’t linked to your account.

Who else sees it

• Cloudflare hosts the site, the API, the database and the saved responses, sends our emails and processes request logs (such as IP addresses) to run and protect the service.
• Stripe processes payments.
• Google, if you choose to sign in with Google.
• Google Analytics and Microsoft Clarity show us how the site is used: pages viewed, clicks and scrolls, device and rough location. When you’re signed in they also get your account id (never your email or API keys).
• Google Ads learns when a visit from one of our ads leads to a sign-up or a purchase (with its amount), so we can tell which ads work.
• Our error tracker, which we run ourselves, receives a report when something breaks: the error, the page and your browser.
• Apps you connect, such as Claude or ChatGPT, receive the results of the calls they make for you, under their own privacy policies.

We don’t sell or rent your data, and beyond measuring our own ads we don’t use it for advertising.

How long we keep it

Account data, keys and usage counts stay until you delete your account. Purchase records are kept as long as tax and accounting rules require. Per-IP counts are only needed for the day they’re counted. The request log is deleted after 14 days and the responses it kept a day later (your account’s first request stays with your account), and our record of the emails we sent you (address, type, whether it went out) after 90 days.

Your choices

Email support@lurkapi.com to get a copy of your data, correct it or delete your account. Deleting your account removes your email, keys and usage counts; we keep purchase records where the law requires it.