Privacy Policy
Last updated: 29 September 2026
This policy explains what API Sky, LLC ("ApiSky", "we", "us") collects when you use the ApiSky service, why we collect it, and what control you have over it.
What we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Name, email address, organization, authentication identifiers | To create and secure your account |
| Code and prompts | Source files you give the assistant access to, your questions, generated output | To provide the assistant's core function |
| Usage data | Which model ran, token counts, timestamps, credits consumed, error events | To bill accurately, enforce limits, and diagnose faults |
| Payment data | Card brand, last four digits, billing country | To process payments. Full card numbers never reach us — Stripe handles them |
| Technical data | IP address, editor and extension version, operating system | Security, abuse prevention, compatibility |
What we do not do
- ApiSky does not train AI models, and does not use your content to train anyone's. Vercel and Fireworks run with zero data retention on our account.
- We do not sell your personal data, and we do not share it with advertisers.
- We do not access your repositories beyond what you explicitly give the assistant.
How your code is handled
When you ask the assistant to do something, the relevant code and your prompt are sent to the AI model provider you selected, processed, and returned to you. We keep usage records so we can bill you correctly.
Each assistant keeps one ongoing chat, and it is stored automatically as you work so the assistant can pick up where you left off. You don't have to save it. To start fresh, you delete the current chat; it is permanently erased within 24 hours. You can also save a named copy of a chat (a saved session) to reopen later. Saved sessions are separate from the ongoing chat and stay until you delete them.
Your organization's owners and admins can see a session report for each chat's work — thread runs, goals and subgoals, status, token and cost figures, and the final summary. Session-report records are kept until your account or the organization is deleted, including for chats you have deleted; owners and admins can still see them, marked as deleted. The final summary is text the assistant wrote about its work, so it can quote parts of your code. Billing and usage records are kept separately, as described below.
Deleting an assistant removes its chats from the app and permanently erases their content within 24 hours; some of its working state may remain until your account is deleted. The saved sessions made with it are deleted at once, and backup copies are erased within 7 days. Its artifacts are kept as your organization's knowledge, and its session-report records are kept as described above.
Each provider's own privacy terms govern what they do with what we send them, and those terms differ between providers. The current provider list is shown in the application. You may also connect your own provider account, in which case your agreement with that provider applies instead of ours.
Who we share data with
| Recipient | Purpose |
|---|---|
| AI model providers | Processing the requests you initiate |
| Stripe | Payment processing and fraud prevention |
| WorkOS | Authentication and single sign-on |
| Amazon Web Services | Hosting and storage (United States) |
| Postmark | Transactional email — receipts, alerts, account notices |
| Vercel | AI gateway for the US labs' models |
| Fireworks | Runs open-source models on US-hosted GPUs |
| Firecrawl | Web search and page retrieval, when you use those tools — your search text and the page addresses you ask for are sent to them |
| Slack | Internal budget alerts, which name the member and the amount spent |
We may also disclose data where legally required, or to protect our rights, users or the security of the Service. If we are ever involved in a merger or acquisition, we will give notice before personal data is transferred.
Where data is held
Data is stored in the United States on Amazon Web Services. If you use the Service from outside the United States, you are transferring data there. Where required, we rely on Standard Contractual Clauses for such transfers.
How long we keep it
We keep the data below while you have an account with us. Delete your account in the app under Profile → Delete account, or email support@apisky.net. It is deactivated for 14 days, when you can ask us to restore it, then permanently deleted — account data, code, conversations, uploads and indexes — within 30 days of your request. Billing and usage records are kept for 7 years.
An organization is deleted the same way when its owner deletes it, or when its only member deletes their account. You can also ask us to erase specific data at any time — see Your rights.
| Data | Retention |
|---|---|
| Account data | Kept while your account is open. When you delete it, the account is deactivated for 14 days, then permanently deleted within 30 days of your request |
| Ongoing chat and generated output | Kept until you delete the chat, the assistant, or your account. A deleted chat is removed from the app at once and permanently erased within 24 hours. Copies in server logs and database backups age out on the schedules below |
| Assistant artifacts | Notes, research and files the assistant saves are kept separately from the chat so your organization's assistants can reuse them. They are kept when you delete an assistant, and deleted when your account is deleted. Temporary working files from a deleted chat are removed the next time that chat is cleared |
| Saved sessions | Kept until you delete them, the assistant they were made with, or your account. Deleting one removes it at once; backup copies are erased within 7 days |
| Session reports | Kept until your account or the organization is deleted, including for chats you have deleted. Owners and admins still see them, marked as deleted. They include the assistant's final summary, which can quote your code |
| Usage and billing records | Kept for at least 7 years, as accounting and tax law requires. These are retained even after your account is deleted or you make an erasure request, because we are legally obliged to keep them |
| Server logs | Up to 30 days, depending on the log |
| Backups | 7 days |
Erasing data from live systems does not immediately remove it from backups. Backups age out on the 7-day cycle above, after which the erasure is complete everywhere.
Security
- All traffic is encrypted in transit with TLS.
- Data at rest is encrypted, including databases and backups.
- Access to the systems that run the Service is restricted, individually authenticated, and logged.
- Credentials are held in a managed secrets store, not in source code.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
Your rights
Depending on where you live, you may have the right to access, correct, delete, export or restrict processing of your personal data, to object to processing, and to withdraw consent. California residents have rights under the CCPA/CPRA, including the right to know and to delete; we do not sell or share personal information as those terms are defined.
To exercise any of these, email privacy@apisky.net. We respond within 30 days. We will not discriminate against you for exercising a right.
Cookies
We use cookies that are necessary for the Service to work — keeping you signed in and protecting against cross-site request forgery. We do not use analytics, advertising or tracking cookies, and we do not embed third-party trackers.
Children
The Service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy. Material changes are announced by email to account holders at least 30 days before taking effect, and the date at the top always reflects the current version.
Contact
API Sky, LLC
126 East 56 Street, Seventh Floor
New York, NY 10022
Privacy enquiries: privacy@apisky.net
General support: support@apisky.net