Privacy
What is stored, for how long, and who else sees it.
Last updated October 9, 2026.
What we store
| Data | Why | Kept for |
|---|---|---|
| The URL you request, its host, and the outcome | Billing, abuse handling, support | Up to 45 days |
| Your IP address, recorded with each request and in our web server logs | Rate limiting and investigating abuse | Up to 45 days |
| Screenshots you ask for | Returning them to you as a download link | 30 days |
| API key hash and an encrypted copy of the key | Authentication, and re-displaying it in your portal | Until the key is deleted |
| Email address, for accounts | Sending the key and billing notices | Until the account is deleted (an ended subscription continues as a free account) |
| PayPal subscription id | Matching a payment to an account | Until the account is deleted |
| Payment records: amount, date and PayPal transaction ids | Accounting, refunds and disputes | Kept after the account is deleted, for accounting |
| Contact-form messages: your name, email, message, IP address, and your browser and the page you came from | Answering you | In our helpdesk until the ticket is deleted |
| Application logs, which can include your email address and IP address | Running the service and fixing faults | 30 days |
What we do not store
The content of pages you fetch is not retained, apart from screenshots you ask for (above). It is streamed back to you and discarded. We keep the URL and the outcome, not the response body. We never see or store a card number: PayPal handles payment and tells us only that a subscription is active.
Send your API key in the Authorization header. If you send it as the
api_key query parameter instead, it is part of the URL, so it passes
through Cloudflare and appears in our web server logs for up to 45 days.
Analytics
The website uses Umami, which runs on our own server, is cookie-free and does not track visitors across sites. Google Analytics is loaded only on the public site, never on API responses, and only once the page is otherwise idle.
Who else sees it
- Cloudflare runs our network edge: every visit and API request passes through it, so it sees your IP address and the request, including the URL. It also delivers our email, so it sees your address and the message, and forwards mail sent to webfetch.io addresses.
- Our hosting providers run the servers the service and its scrapers operate from, so requests pass through their networks.
- PayPal processes subscriptions and holds the billing relationship.
- Our proxy providers carry requests sent through a proxy, so they see the target URL.
- worldip.io receives the IP address of anyone who uses the contact form, so the message can show your country and network.
- webshot.site, a sister service, receives the URL when you ask for a screenshot and our own renderers cannot take it.
- The site you are scraping sees the request, as it would from any client.
We do not sell data, and we do not share it for advertising.
Your requests
To get a copy of what we hold about your account, or to have it deleted, write to [email protected] from the address on the account. Deleting the account removes its keys, its account records and your email address, including from our admin log. Request records and application logs age out on the schedule above, and payment records are kept for accounting.
Contact
Tuxxin LLC, via the contact form, [email protected], or (689) 300-4505 (Monday to Friday, 9:00 AM to 6:00 PM ET). By mail: Tuxxin LLC, 10226 Curry Ford Road, Suite 107 PMB 1192, Orlando, FL 32825, United States.