Privacy Policy

Last updated 30 October 2026. Controller: Apilow Tech, Belgium. Contact for anything in this policy: contact@apilow.com. Data is hosted in the European Union.

If you are a KeyTriage user

What we keep: your email address, sign-in times, your games, your settings, the emails you forward or paste (sender, subject, body, links), the facts we retrieve about the channels they mention, verdicts, your decisions and reports, and billing references (Stripe customer id, plan). Card details never reach us: Stripe handles payment.
Why: to provide the service (contract), to send you the sign-in link and service notices (contract), and to improve verdicts for all users through the shared database (legitimate interest, which you can switch off in Settings).
How long: the original email source is deleted 90 days after receipt. Extracted facts, verdicts and decisions stay while your account exists. Verification cache entries are kept at most 30 days. Deleting your account erases everything you own; shared sender rows only lose the link to you.
Who else sees it: our hosting provider (EU), Stripe for payments, Resend for sign-in emails, and the platforms we query to verify channels (YouTube Data API, Twitch, Steam, domain registries) which receive only the public channel identifier or domain, never your email. When an LLM second opinion is enabled, the email text and the verified facts are sent to Anthropic's API for that single analysis and are not used to train models.

If someone forwarded an email you sent

A developer who received your key request may have had it analyzed by KeyTriage. We then hold your email address, display name, the text of that email, the public links it contains, and the developer's assessment of it.
The legal basis is the legitimate interest of developers in protecting their game keys from resale fraud, balanced against your interests: nothing is published, the pool is only used to inform other developers' assessments, and your address is masked in any public answer.
Retention follows the same rules as above: the email source is deleted after 90 days, aggregate facts about the address (how often it was seen, reports) stay while they remain relevant, at most three years after the last email.
You can ask what we hold about your address, ask for correction, or object to the processing by writing to contact@apilow.com from that address. We answer within one month. If you believe a report about you is wrong, say so: reports are opinions of individual developers and we will review them.

Cookies

One session cookie after sign-in, strictly necessary. No advertising or cross-site tracking.

Your rights

Access, rectification, erasure, restriction, portability and objection, as provided by the GDPR, by email to contact@apilow.com. You can also complain to the Belgian Data Protection Authority (autoriteprotectiondonnees.be).