Privacy Policy

APIShort ("we", "us", "our") operates the website apishort.com and provides a transparent API proxy service for short drama platforms. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

1. Information We Collect

Account Information (via Google OAuth2):

• Your Google account name
• Your Gmail email address (only @gmail.com accounts are accepted)
• Your Google profile picture URL

Service Data:

• API key (generated server-side upon registration and stored in our database)
• API usage logs: IP address, daily request count, and timestamps
• Account creation date and last login time

Automatically Collected:

• IP address (for rate limiting and abuse prevention)
• HTTP request headers sent to our API endpoints

2. How We Use Your Information

• Authentication: Verify your identity and manage your account via Google OAuth2
• API Key Management: Generate, store, and validate your unique API key
• Rate Limiting: Enforce daily request limits (100 requests/day on the free plan) and prevent abuse
• Service Improvement: Analyze aggregate usage patterns to improve our service
• Communication: Contact you regarding your account or service changes if necessary

3. Data Storage & Security

• Your data is stored in a SQLite database on our secure server infrastructure
• Session authentication uses HMAC-signed, httponly, secure cookies with a 30-day expiry
• We do not store passwords — authentication is handled entirely through Google OAuth2
• API keys are generated using cryptographically secure random tokens
• All connections to our service are encrypted via HTTPS (TLS), managed through Cloudflare

While we implement commercially reasonable security measures, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.

4. Google API Services — Limited Use Disclosure

• We use Google OAuth2 solely for authentication
• We access only: your email address, display name, and profile picture
• We do not access your Google contacts, Google Drive, Google Calendar, Gmail messages, or any other Google service data
• We store only the minimum data necessary for account authentication and API key management
• We do not sell, share, or transfer your Google user data to third parties except as necessary to provide the service
• We do not use Google user data for serving advertisements
• We restrict @gmail.com accounts only to prevent mass account creation through organizational Google Workspace accounts

5. Cookies & Local Storage

Cookies:

• vbs_session — A session cookie used for authentication. It is httponly (not accessible via JavaScript), secure (sent only over HTTPS), and expires after 30 days. This cookie is essential for the service to function.

Browser Local Storage:

• Your API key may be saved to your browser's localStorage for convenience when using the API documentation tryout feature. This is optional and user-initiated via the "Save" button. This data remains in your browser only and is not transmitted to our servers.

6. Third-Party Services

We use the following third-party services:

• Google OAuth2: For user authentication. Subject to Google's Privacy Policy.
• Cloudflare: For CDN, DNS management, and DDoS protection. Subject to Cloudflare's Privacy Policy.
• Upstream Drama Platforms: API requests are transparently proxied to upstream short drama platforms. The data returned by these platforms passes through our servers but is not stored, cached, or modified by us.

7. Data Retention

• Account data (name, email, profile picture, API key) is retained for as long as your account remains active
• Usage logs (daily request counts per user/IP) are retained for operational purposes and cleaned periodically
• You may request deletion of your account and all associated data by contacting us at [email protected]
• Upon deletion, all personal data will be permanently removed from our database

8. Your Rights

You have the right to:

• Access your personal data at any time through your dashboard
• Rectification — your name and profile picture are synced from your Google account on each login
• Delete your account and all associated data by contacting us
• Regenerate your API key at any time from the dashboard, immediately invalidating the old key
• Know what data we collect about you (as described in this policy)
• Object to certain processing of your data by contacting us

9. Children's Privacy

Our service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that a child under 13 has provided us with personal information, we will promptly delete such information from our servers. If you believe we may have collected information from a child under 13, please contact us at [email protected].

10. International Users

Our servers and data may be located and processed in various countries. By using our service, you consent to the transfer and processing of your data internationally. We take reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy regardless of where it is stored or processed.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the service after changes are posted constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

• Email: [email protected]
• Website: apishort.com