Security and data handling
What we store, for how long, and what you can lock down. Everything on this page is taken from our Terms of Service, Privacy Policy and documentation.
API keys
Stored as hashes
The full key is shown once, when you create it. We only store a one-way hash of API keys and session tokens, so a lost key cannot be recovered: revoke it and create a new one.
IP allowlists
Each key can have an allowlist of up to 20 IP addresses or CIDR ranges, IPv4 and IPv6. Requests from other addresses fail with 403 IP_NOT_ALLOWED, so a leaked key is useless outside your infrastructure.
Server-side only
The API refuses browser requests, and keys sent in the URL are rejected with API_KEY_IN_URL because URLs end up in logs and browser history. Keep keys in an environment variable on your server.
Rotation and revocation
You can have up to 10 active keys, each with a Last used time. Revocation takes effect immediately. Repeated failed authentication attempts from one IP address are blocked for a few minutes (AUTH_BLOCKED).
Cache and privacy
A 14-day cache window
Results of successful requests are kept in a results cache for up to 14 days so you can reuse them with cache_days, and are then deleted. Without cache_days, every request returns live data.
Your cache is private
Cached results belong to your account. Another customer requesting the same profile never receives your result, and your cache hits never reveal what others fetched.
What we keep, and for how long
- Request history: 180 days. Endpoint, target, time, status, credits charged and the IP address the request came from.
- Cached results: up to 14 days.
- Sessions: up to 30 days after your last visit and at most 90 days, or until you sign out.
- Account details: while your account is open. When you ask us to delete your account, we delete or anonymize your personal data within 30 days, except records we must keep by law.
- Security and technical logs: as long as needed to protect the Service and investigate abuse.
- Backups are overwritten on a regular cycle.
Connections are encrypted with HTTPS, stored credentials are encrypted, and access is limited to the people who need it to run the Service. If a breach affects your data, we will notify you as required by law. Details are in the Privacy Policy.
Public data only
No logins
The Service retrieves information that is publicly available on third-party websites without logging in. It does not access private accounts or content behind a login, and requests to platforms are made by our servers without your account details.
Removal requests
If the Service returned public data about you and you want cached copies removed, email info@scrapeeverything.com with the link or username and we will delete them. You remain responsible for how you use the data you request; see the Terms of Service.
Payments
Credit packs are sold by Senyo Labs Technology, the company that operates Scrape Everything. We accept crypto today. Credit card payments are coming soon. Crypto payments go through 2328, our crypto payment processor: you get a 2328 invoice page with the exact amount, network and address. We never see or store your wallet keys. We keep the package, amount, currency, status and the payment processor's reference, for as long as tax and accounting laws require. How paying with crypto works.
Responsible disclosure
Found a vulnerability? Email info@scrapeeverything.com with a description, the steps to reproduce and any request_id involved. Please do not access other customers' data or disrupt the Service while testing, and give us reasonable time to fix the issue before sharing it publicly.