Account information and its purposes
We store your email address, password hash, API key hash and key prefix to support account access and authentication. Passwords are not stored as plaintext. Credit-usage information supports request accounting. IP information is used for abuse prevention, and payment transaction records support payment verification and credit accounting. These are descriptions of stored-data categories; the policy does not publish actual credential hashes or a user's payment history.
Sessions, invoice recovery and analytics
Authentication uses a Secure HttpOnly session cookie. Separately, the account widget keeps invoice and user identifiers in localStorage for the current hostname so an invoice can be recovered. The raw API key is not persisted in browser storage. The session cookie does not make localStorage HttpOnly. Public pages include Statinside analytics counter 43; this policy makes no cookie-free claim and does not specify unverified analytics fields.
Retention and the boundary of this policy
No fixed retention period or automatic deletion deadline has been specified for account, abuse-prevention or payment information. That uncertainty does not establish a particular deletion workflow. It also does not describe how long archived Reddit records remain available. Account-data handling and archive coverage are separate questions. This policy supplies no operator identity, jurisdiction or contact procedure beyond the account functions actually available on the site; no configured support mailbox is announced here.
