Tiếng Việt Sign inGet free API key

Privacy Policy

Last updated: 2026-11-10

What we collect

  • Account: e-mail address, optional name, password (stored only as a salted PBKDF2 hash), language, plan.
  • Usage counters: number of requests per endpoint per day, last use of each API key. Used for your quota and statistics; kept about 13 months.
  • Payments: order code, plan, amount, status and the payment reference from SePay or PayPal. We never see or store card numbers. Paid orders are kept as long as required for accounting.
  • Webhook tester: requests sent to your bins (method, headers, body up to 256 KB, sender IP), kept until you delete them or the bin expires (24 hours without an account, 30 days with one).
  • Uptime monitors: the URLs you monitor, their settings and check results (status code, response time, error), plus incidents for 90 days; deleted with the monitor or your account.
  • Form endpoints and JSON store: the submissions your forms receive (fields, plus the sender's IP address, country, browser user agent and referring page, for you as the form owner) and the JSON documents you store, kept within your plan's limits and deleted with the form, the document or your account.

What we do not keep

The content you send to the APIs (HTML, JSON, texts, files, URLs, e-mail addresses to validate, ID and tax numbers, salaries, addresses, 2FA secrets, passwords, card numbers…) is processed in memory to build the answer and is not stored. Some public results (metadata, SEO, security-header and sitemap checks of a URL, feeds, DNS answers, IP lookups, WHOIS / RDAP records, exchange rates) are cached for up to 24 hours to answer faster.

Processors

  • Cloudflare (hosting, database, Turnstile anti-abuse check, optional cookieless Web Analytics).
  • SePay and PayPal (payments).
  • Resend (account e-mails, when enabled).
  • Google AdSense (advertising on public pages, not in the dashboard).

Cookies and advertising

The dashboard uses one essential cookie (abx_session) to keep you signed in. Public pages may show ads served by Google. Google and its partners use cookies to serve ads based on your visits to this and other websites. You can opt out of personalised advertising at Google Ads Settings or aboutads.info. Visitors from the EEA, the UK and Switzerland are asked for consent through Google's consent message.

Your rights

You can see and change your data in the dashboard, export it on request, and delete your account at any time (Account → Delete account), which removes your keys, statistics, webhook bins, uptime monitors, forms and JSON documents immediately. Write to support@apibox.io.vn for any request.

Security

All traffic uses HTTPS. API keys are stored only as SHA-256 hashes: we cannot show a lost key again, create a new one instead.