Terms & Privacy

ApiArk is operated from Switzerland, where the gateway nodes and the service data also live. For any question about this page, about your data, or to request deletion, write to [email protected]. Requests are handled personally, usually within a few days.

Creating an account stores the following in our database:

• Your email address and, if you provide one, your name.
• A hash of your password. The plaintext password is never stored.
• Your CLI token and the gateway consumer keys you create.
• An activity log of account events (sign-in, route creation, and similar), each with a timestamp and the IP address the request came from.
• If you subscribe to a paid plan, the Stripe customer and subscription identifiers. Card details go to Stripe directly and never reach our servers.

This is the part that matters most, so it is written plainly. When a request hits a route you created, the gateway terminates TLS, checks the API key, applies the rate limit, and forwards the request to your backend.

The gateway writes a log line per request to a file on the gateway host. That log line covers the request metadata: method, path, status code, latency, and the request headers. Request and response bodies are not captured. We do not run body inspection, and payloads are not written to disk or forwarded anywhere else.

One consequence worth stating: because the log line includes request headers, and API keys travel in a header, keys can appear in the gateway log file. That file lives on the gateway host and is not exposed publicly, but treat any key you have used as rotatable, and rotate it if you have reason to.

Gateway logs are kept for troubleshooting and are not sold, shared, or used to build any profile of you or your users.

Running ApiArk means a handful of third parties necessarily see some data: Vercel hosts the dashboard, Oracle Cloud hosts the gateway nodes, Cloudflare sits in front of the public endpoints, and Stripe handles payments. Each of these sees only what it needs to do its job.

You can ask for a copy of what we hold about you, ask for corrections, or ask us to delete your account and everything attached to it. Email [email protected] and say which one you want. Deleting your account removes your routes and consumers from the gateway as well.

Swiss data protection law (the FADP) covers the service. If you are in the EU, the GDPR gives you these rights as well, and you can complain to your national data protection authority. Switzerland holds an EU adequacy decision, so your data does not leave a jurisdiction the EU considers equivalent.

The service is free at the stated limits and provided as is. There is no uptime guarantee, no support SLA, and no promise that a given route will still exist next month. The gateway runs on two nodes operated by one person, and it can go down.

Do not put anything on ApiArk that you cannot afford to lose or have interrupted. Keeping production traffic behind it is possible, and some people do it, but that is your risk to take with the above in mind.

We may change the free limits or the terms of the beta. Material changes get announced by email to registered users before they take effect.

If you joined through the Pioneer program, the Pioneer beta terms cover that program specifically and apply on top of this page.

No malware distribution, phishing, or content that is illegal where the gateway nodes run. No using ApiArk to attack or scan third parties. Accounts doing any of this get terminated without notice, which is the only place in this document where anything happens without warning.

The date at the top reflects the last revision. Older versions are in the project git history, so nothing here changes quietly.