FreeAPI
Back to Home

Privacy & Data Processing Policy

Last Updated: August 31, 2026 • GDPR & KVKK Compliant

1Data Controller & What Information We Collect

FreeAPI ("Platform") acts as the Data Controller in accordance with the EU General Data Protection Regulation ("GDPR") and applicable data protection legislation. We collect only the minimum data strictly required to deliver developer tooling:

  • Identity & Account Data: When registering via GitHub, Google, or email, we process your public profile name, avatar URL, and email address. Passwords are never stored in plaintext and are salted/hashed with cryptographic primitives (Argon2id/Bcrypt).
  • Developer Workspace & Preferences: Bookmarked APIs, created architectural Stacks, and UI theme states are stored in our relational database and/or browser local storage (localStorage).
  • Technical Telemetry: IP addresses, browser User-Agent headers, operating system signatures, and request timestamps are logged solely for Edge WAF defense, anti-scraping, and rate-limiting enforcement.

2Telemetry, Anonymized Usage Data & AI Training

To optimize discovery algorithms, assess API latency patterns, and build modern developer tooling:

  • We collect search trends, category filter distributions, sandbox execution metrics, and latency percentiles.
  • All such analytical data is fully stripped of personal identifiers (completely aggregated and anonymized).
  • FreeAPI retains the right to utilize aggregated telemetry for platform reliability engineering, AI model fine-tuning, automated prompt engineering, and developer industry trend reporting.

3Proxy & Sandbox Request Logging

When utilizing interactive sandbox runners, requests are dispatched directly to the target API endpoint as a transparent pass-through proxy. Secret API keys, private tokens, and confidential request payloads provided by users are never persisted or stored in our databases.

4Cookies & Security Measures

We use strictly necessary HTTP-Only, SameSite=Lax session cookies for authentication state management. We do not sell, rent, or lease personal information to third-party data brokers or marketing ad networks.

5User Rights & Data Deletion Requests

Under GDPR Chapter 3 and KVKK Article 11, you have the right to access, rectify, export, or permanently erase (Right to be Forgotten) all personal data associated with your profile.

To initiate an account closure or data erasure request, contact our team at contact@canpolatkaya.com. All requests are processed within 7 business days.