# Privacy Policy - ApiTraffic > What ApiTraffic collects, why, who we share it with, and how long we keep it - including our mobile messaging data. Source: https://dev.apitraffic.io/privacy # Privacy Policy Last updated October 27, 2026 This policy covers apitraffic.io and the ApiTraffic platform. It describes what we collect, why we have it, who else ever sees it, and what you can ask us to do with it. ## What we collect **Account information.** The name, work email address and password you supply when you create an account, plus the account and billing details needed to run a subscription. **Authentication data.** If you enable multi-factor authentication: an encrypted authenticator secret, registered passkey identifiers, and - only if you choose text-message verification - the mobile number you enter, stored encrypted, along with the record of your consent to receive messages at it. **Telemetry you send us.** The API traffic your services report through our SDKs: request and response metadata, timings, status codes, and - only where you turn it on - request and response bodies. Redaction and exclusion rules run inside your process before transmission, so anything you mask or exclude never reaches us at all. **Product usage.** Sign-in times, IP address and user agent for security purposes, and which parts of the application an account uses. **Website analytics.** On apitraffic.io we use Google Analytics to count visits and see which pages and buttons are used: pages viewed, how far down a page you scroll, links and buttons clicked, docs searches, and the approximate location, device and browser Google derives from your connection. Advertising features, ad personalisation and Google signals are off. Visitors in the European Economic Area, the UK and Switzerland are counted without analytics cookies. If your browser sends a Global Privacy Control or Do Not Track signal, the site does not load Google Analytics at all. ## What we use it for - Providing the platform: storing, indexing and displaying the telemetry you send. - Authenticating you, including sending verification codes to a number you enrolled. - Billing, and telling you about limits, overages and service changes. - Security: detecting abuse, investigating incidents, and keeping an audit trail. - Support, when you contact us. We do not sell personal information, and we do not use the telemetry in your account to train models for anyone else. ## Mobile information and text messages **No mobile information is sold. No mobile information - including phone numbers, text-message opt-in data, and consent records - is shared with third parties or affiliates for marketing or promotional purposes.** A phone number you enroll for verification is used to send you verification codes and nothing else. It is disclosed only to the messaging carrier that delivers the message, which is a processor acting on our instructions and cannot use it for its own purposes. You can remove the number at any time from Account → Security, or by replying STOP to any message. Removing it deletes the number and its consent record. The full description of the messaging program is on the [messaging terms](/legal/messaging) page. ## Who else sees your data Sub-processors only, each performing a specific function on our instructions: cloud infrastructure and storage, our messaging and email providers, payment processing, error and performance monitoring, and website analytics (Google Analytics, for visits to apitraffic.io only). They may use the data only to provide that service to us. We otherwise disclose data only where we are legally required to, and where we can, we will tell you first. Email [sales@apitraffic.io](mailto:sales@apitraffic.io) for our current sub-processor list or a data processing agreement. ## How long we keep it Telemetry is kept for the retention period of your plan; captured bodies and searchable metadata are separate entitlements and can expire on different schedules. Account records are kept for as long as the account exists. When an account is closed, its telemetry is deleted. Records we are required to keep for tax or legal reasons are kept for as long as that requirement lasts, and nothing longer. ## How it is protected Data is encrypted in transit and at rest. Authentication secrets - MFA secrets, phone numbers, backup codes - are encrypted with a separate key rather than stored alongside ordinary account fields. Access is role-based and multi-factor authentication can be required across an account. The controls the platform applies to your telemetry, including in-process redaction, are described on the [security page](/security). ## Your choices - Access, correct or export the data held in your account. - Delete an enrolled phone number, a passkey, or the account itself. - Ask us what we hold about you, and ask us to erase it. Write to [support@apitraffic.io](mailto:support@apitraffic.io) and we will answer within one business day. ## Changes to this policy If we change this policy in a way that affects how we use data we already hold, we will tell account holders by email before it takes effect. The date at the top always reflects the current version.