Privacy policy

Who we are

saveapi.org is operated by Turginboyev Ahror, sole proprietor, Tashkent, Uzbekistan. It provides an HTTP API that turns a public social-media link into direct media URLs and metadata. This policy explains what we record when you use the site and the API, why, and for how long.

What we collect

When you sign in:

• +Through Telegram — your Telegram user ID, first and last name, username and profile photo URL, as sent to us by Telegram. We never receive your phone number or your messages.
• +Through Google — your Google account ID, email address, display name and profile picture URL. We request only the openid, email and profile scopes; we cannot read your mail, files or contacts.

When you call the API:

• +The link you asked us to resolve, the endpoint used, the response status, how long the request took, your IP address and your User-Agent header.
• +Counters of how many requests each of your keys has made, per day and per calendar month.

We do not collect or store payment card details — see "Payments" below. We do not use analytics or advertising trackers, and the site sets no third-party cookies.

What we do not do

• +We never download, copy or store the media itself. The API returns links that point at the source platform's own servers; the files do not pass through us.
• +We do not sell your data, and we do not share it with advertisers or data brokers.
• +We do not store your API keys in a readable form. Only a SHA-256 hash is kept, which is why a key can be shown to you exactly once.

How long we keep it

• +Per-request records — including the resolved link and your IP address — are deleted automatically after 90 days.
• +Daily totals per key (counts only, no links and no IP addresses) are kept while your account exists, because they are your billing history.
• +Account details stay until you ask us to delete the account.
• +Sign-in sessions expire 30 days after your last visit, or immediately when you sign out.

Cookies

One cookie, set only after you sign in. It holds a random session identifier and nothing else — no personal data is stored inside it. It is marked HttpOnly, so scripts on the page cannot read it, and SameSite=Lax, so other sites cannot use it on your behalf. There are no advertising or analytics cookies.

Who else sees the data

• +Telegram and Google — only during sign-in, and only because you chose that method.
• +Our hosting provider (Hetzner Online GmbH, Germany), which operates the servers the data sits on.
• +Paddle.com Market Ltd (UK) and Paddle.com Inc. (US), which act as our reseller and merchant of record when you pay by card — see "Payments" below.
• +Law enforcement, if we are legally required to respond to a valid request.

To resolve a link, our servers contact the platform that hosts it. Those requests carry our infrastructure's address, not yours.

Payments

Card payments are taken by Paddle, our reseller and merchant of record. When you buy a credit pack, Paddle collects your name, email address, billing country and card details on its own checkout and processes them under its privacy policy (paddle.com/legal/privacy). We never see the card number. Paddle sends us the order identifier, the pack bought, the amount paid, your email and billing country, and we keep those with your account as your purchase history.

Crypto payments go through NOWPayments; in that case we receive the order identifier, the currency and the amount paid, and no personal data beyond what your account already holds.

Your choices

• +Ask for a copy of the data tied to your account, or ask us to delete the account and everything attached to it.
• +Revoke any API key at any time from the dashboard; it stops working immediately.
• +Sign out of every device from your account settings.

Write to privacy@saveapi.org and we will answer within 30 days.

Changes

If this policy changes in a way that affects what we collect or how long we keep it, we will update the date at the top and tell account holders by email or in the dashboard before the change takes effect.