Privacy Policy

Last updated · 2026-05-27

1. What we collect

The minimum we need to run an API service and bill you for it:

• Email address — for account identification, magic-link login, billing notifications, and incident communication.
• Google account identifier and basic profile if you sign in with Google — your stable Google subject ID (sub), email, and verified-email flag. We do not receive your Google password.
• Usage logs — for every API call: the endpoint hit, timestamp, IP address, and the API key (or session) used. Retention is 48 hours for raw rows; rolled into (tenant, day, endpoint class) aggregates for billing and capacity planning thereafter.
• API keys you create — stored at rest as you provided them (no hashing today; rotating a leaked key is the recovery path).
• Session records when you log in to the dashboard: a session ID, IP, user agent, and timestamps. Used for revocation and to show you "where am I signed in".
• Subscription state from Creem webhooks — plan, status, period boundaries. We do not receive your card details.

2. What we don't collect

• Payment card numbers, CVVs, or bank details. Payment is handled end-to-end by Creem (our Merchant of Record).
• Any data about queries you make through the API. Your API calls hit our endpoints, and the results stream back, but we do not log the response bodies — only metadata about which endpoint was called.
• Browser fingerprints, device IDs, advertising IDs, or any tracking pixels.
• Sensitive personal data outside of what is listed in §1. If you accidentally include sensitive data in a custom field (e.g. as a key label), we will treat it under §1 but ask that you not.

3. Why we collect it

• Account operation — email + auth identifiers gate the API key issuance and dashboard login.
• Quota and abuse prevention — usage logs enforce per-tenant rate limits and protect against credential theft.
• Billing — usage aggregates feed monthly invoice generation. Subscription state from Creem reconciles to your local plan.
• Operational health — IP and user agent on session rows let us help you when you ask "where am I signed in" or "revoke the laptop I left at the airport".
• Security incident response — IP and session records help us trace and contain credential compromise if it occurs.

4. Who we share it with

We do not sell your data. We do not share with advertisers. The only third parties that touch your data are subprocessors necessary to run the service:

• Google — only if you sign in with Google. We use Google's standard OpenID flow; Google sees us identifying you, but we do not transmit your usage data to Google.
• Resend — sends the magic-link emails. Resend processes your email address and the link text. They are bound by their own privacy terms (resend.com/legal/privacy-policy).
• Creem — Merchant of Record for payments. They process the card transaction end-to-end (including VAT / sales tax) and send us a webhook with the resulting subscription state; we never receive card numbers. Their privacy policy is at creem.io/privacy.
• Cloudflare — sits in front of our origin via Cloudflare Tunnel. They terminate TLS and can see request metadata. They do not see request bodies once decrypted (origin only).
• Sentry — receives application error reports. We have send_default_pii=False and only tag with your tenant ID (integer) and a hashed email — never the plaintext email or your queries.

5. Cookies

We use exactly one cookie: session_id, set when you sign in to the dashboard. It carries a signed reference to your server-side session row. It is HttpOnly, Secure (in production), and SameSite=Lax. We do not use analytics or advertising cookies. Programmatic access (API keys) does not set any cookies.

6. Data retention

• Raw usage_log rows: 48 hours.
• Usage aggregates (rolled by tenant, day, endpoint class): kept as long as your account exists.
• Account record (email, plan, subscription state): kept until you request deletion (see §7).
• Magic-link tokens: stored as SHA-256 hashes; deleted (consumed_at set) after one use or 15 minutes, whichever comes first.
• OAuth state tokens: 10 minutes, single-use.
• Session rows: max 30 days from issuance, or until you log out.
• Logs in our infrastructure: 30 days, then aggregated or expired.

7. Your rights (GDPR / CCPA)

If you are an EU/EEA, UK, or California resident — and in fact regardless — you have:

• Access — email [email protected] and we will export everything we hold on your account.
• Deletion — same email. We delete your account record and usage aggregates within 30 days. Invoiced amounts and tax records may be retained for legally-mandated periods (typically seven years in the US).
• Correction — update your email through the dashboard. Other fields: email us.
• Portability — same channel; we deliver in JSON.
• Objection — you can stop us processing your data by deleting your account. We do not run any processing that does not require an active account.
• Lodging a complaint — if we have not resolved a concern to your satisfaction, you may contact your local data protection authority.

8. International transfers

Our infrastructure is currently operated in the United States. If you sign up from outside the US, your data is transferred to and processed in the US. Our subprocessors (§4) operate globally; refer to their privacy pages for the specific transfer mechanisms they rely on (standard contractual clauses, etc.).

9. Children

Rockmoon is intended for use by adults building financial-data applications. We do not knowingly accept accounts from children under 16. If you believe a child has registered, email us and we will delete the account.

10. Security

We follow established practice: passwords are never stored (we use magic links and OAuth instead); credentials are sent only over TLS; API keys can be revoked from the dashboard at any time; session cookies are signed and revocable. That said, no online service is invulnerable — if you believe your account has been compromised, revoke your keys from the dashboard immediately and email us.

11. Changes to this policy

If we make material changes we will email every active account at least 30 days before they take effect. Minor changes (typos, additional clarifying language) we update in place and bump the "Last updated" date at the top. You can always read the current version at /privacy.

12. Contact

For anything privacy- or data-related: [email protected]. For everything else: [email protected]. We typically reply within two business days.