Privacy Policy

Last updated: December 29, 2025

1. Introduction

This Privacy Policy explains how Alychan API (“We”) collects, uses, stores, and protects user (“You”) information in the use of our paid REST API services (“Services”).

2. Information we collect

a. Account Information

We collect information you provide when registering or using the Services, including:

Email address
Authentication method (email, Google, or Discord)
Internal account identity (user ID)
Subscription package status and credit usage

We do not store passwords in original text form.

b. Authentication and Session Information

For login and account security purposes, we use cookies to store authentication sessions.

Session identity (session ID in hashed form)
Session creation time and last activity
Technical information regarding devices and browsers

We do not store cookie values directly, raw authentication tokens, or other sensitive credentials.

c. Technical Information and Activity Log

We automatically collect technical information when the Services are used, including:

IP Address, User-Agent
Accessed API endpoint
HTTP method and response status, Access time and response duration
Authentication activity (successful/failed login, logout)

These logs are used for security purposes, performance monitoring, billing, and preventing misuse of the Service.

d. Payment Information

For paid Services:

Transaction information is processed by third party payment gateway providers.
We only store administrative transaction data, such as transaction ID, amount, status and payment time.
We do not store payment card data, CVV or other sensitive financial credentials.

3. How We Use Information

The information collected is used to:

Provide and operate API Services.
Authentication, authorization and management of user sessions.
Billing, package management, and recording credit usage
System monitoring, performance analysis, and debugging
Prevention of fraud, abuse and unauthorized activities
Compliance with legal obligations

4. Cookies and Similar Technologies

We use cookies on a limited basis to:

Maintain user login status
Manage authentication sessions securely

Cookies are not used for advertising or cross-site tracking purposes.

5. Data Storage and Retention

Data and logs are retained as long as necessary for operational, security and legal purposes.
Technical and activity logs are generally retained for a limited period of time and can be deleted or anonymized once they are no longer needed.
Transaction data is stored in accordance with applicable legal provisions.

6. Sharing Information with Third Parties

We do not sell or rent users' personal data.

Provider of infrastructure and supporting services (hosting, monitoring, payment gateway)
Legal authority if required by statutory regulations

These third parties only have limited access according to service requirements.

7. Data Security

We implement reasonable technical and organizational security measures, including:

Communication encryption (HTTPS)
Internal access restrictions
Monitoring and auditing system activities

However, no system is completely secure and we cannot guarantee absolute security.

8. User Rights

Users have the right to:

Access, correct or delete their personal data in accordance with applicable legal provisions.
Refuse or restrict data processing under certain conditions.
File a complaint with a data protection authority if you feel your rights have been violated.
Stop using the Services

Data deletion requests may be limited by legal obligations or system security requirements.

9. Third Party Authentication

Our service supports authentication through third parties such as Google and Discord. We only accept basic information necessary for account identification and do not control the privacy policies of these third-party providers.

10. Privacy Policy Changes

We may update this Privacy Policy from time to time. Changes are effective as soon as they are posted on this page.

11. Applicable Law

This Privacy Policy is governed by the laws of Indonesia. Any disputes arising from this Privacy Policy shall be resolved through legal channels in accordance with applicable jurisdiction.

Have questions about this Privacy Policy?