Privacy policy

Last updated: 22 October 2026

dontlosedata ("we", "us") is run by DontLoseData at dontlosedata.site. It stores data for apps behind a single web address. This page explains what we collect, why, how long we keep it and how you can delete it. If anything is unclear, email [email protected].

The short version

• We only ask Google for your name, email address and profile picture.
• We use them to sign you in and show your account. That's all.
• We don't sell your data, show ads or use your data to train AI models.
• You can delete your account and everything in it at any time.

Signing in with Google

Accounts are created only through "Sign in with Google". We have no passwords. When you sign in, Google shares the following with us, and only after you agree on Google's screen:

• Your name, shown in your account.
• Your email address, used to recognise you, to contact you about your account and to grant admin access to the people who run the service.
• Your profile picture (a link to it), shown in the menu.
• Your Google account ID, so we recognise you the next time you sign in.

We don't get access to your Gmail, Drive, contacts, calendar or any other Google data, and we can't post or act on your behalf.

Our use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements. We don't sell or transfer Google user data to anyone, use it for advertising, use it to train AI or machine learning models, or let people read it, except when you ask us to, when it's needed for security or abuse investigations, or when the law requires it.

You can remove dontlosedata's access at any time from your Google account connections. This stops new sign-ins. To delete what we already have, delete your account (see below).

What else we store

The data you save

Whatever your app saves in an endpoint is stored as you sent it. We only look at it to keep the service working or to investigate abuse. You decide what goes in. Please don't save other people's personal details there (see the terms).

Request logs

For every request to an endpoint we log the time, method, address, result, size, duration, IP address, the website it came from and the browser or tool that sent it. Logs power your request history, usage limits and abuse protection. They are deleted after 90 days, and they are kept for that long even after the endpoint or account is deleted, so abuse can still be investigated.

Abuse protection

When an IP address, website or endpoint sends suspicious traffic (for example many failed or oversized requests), we record it for review and may block it. Blocks stay in place until we lift them.

Diagnostics

Server error and debugging logs may include request details. Debugging records are deleted after 48 hours.

Cookies and local storage

We only use cookies the site needs to work. There are no analytics, tracking or advertising cookies.

• Session cookie: keeps you signed in and remembers the endpoint you made on the homepage.
• Security cookie (XSRF-TOKEN): protects forms from being sent by other websites.
• Remember-me cookie: keeps you signed in between visits until you sign out.
• Theme setting: stored in your browser (not a cookie) if you switch to the light theme.

Who we share data with

We don't sell or rent data. It's only handled by:

• Google, for sign-in.
• Our hosting providers, who run the servers and databases for us and may not use the data for anything else.
• Authorities, only when the law requires it.

Anyone who has an endpoint's address can use that endpoint unless you protect it with an API key. Treat the address like a password.

How long we keep things

• Your account: until you delete it.
• Endpoints: until you delete them, or automatically when they go unused for longer than your plan allows.
• Request logs: 90 days.
• Debugging records: 48 hours.

Deleting your data

Go to Account and press Delete my account. Your account, endpoints, their data and your API keys are deleted straight away. You can also delete a single endpoint from its page. If you can't sign in any more, email [email protected] from the address on the account and we'll delete it for you.

Your rights

Depending on where you live, you may have the right to see, correct, export or delete your data, or to object to how we use it. Most of this you can do yourself from the dashboard. For anything else, email [email protected] and we'll reply within 30 days.

Security

All traffic is encrypted (HTTPS). API keys are stored encrypted, and only you can see them in your dashboard. No system is perfectly secure, so keep your own copy of anything important.

Children

dontlosedata is not meant for children under 16, and we don't knowingly create accounts for them.

Changes

If we change this policy, we'll update the date at the top. If a change affects how we use your Google data, we'll tell you by email or in the app before it takes effect.

Contact

DontLoseData, dontlosedata.site. Questions or requests: [email protected].