Privacy

For a single request we keep its host name, never the full URL. A batch or a monitor keeps the URLs you give it, because it needs them to run. Your key, your headers and your IP address never reach a log.

A single request

For each request to /v1 we keep one record: its id, the time, the key, the engine, the result, the credits and the target’s host name, like example.com. We never write the full target URL, its path or its query, your request headers, your cookies or your IP address into a log or a table. GET /v1/account/requests shows you your records.

When the url is a PDF, Word, PowerPoint or Excel file, the record also keeps its kind and the pages, slides, characters or cells we priced. We never log or store the file or its text.

A batch

A batch needs its URLs to run them. We keep them while the batch runs, and we delete the whole batch and its items 7 days after it ends. Each result is deleted 7 days after it is saved, whatever your account’s retention_days says: that setting covers request records, and a value under 7 does not remove results sooner. You can delete the data sooner: once a batch has finished or been canceled, DELETE /v1/batches/{id} with an account key deletes its results, its URLs and the headers and cookies you sent with it at once. Your credit ledger is separate and stays. A result_url works for 15 minutes, for anyone who holds it: treat it like a password.

A monitor

A monitor needs its URLs to check them on schedule. They live only in the monitor: only you can read them, and they never appear in our logs, our check rows or our storage keys. While a check runs, its pages are a batch, so the URLs are in our database until the check ends; then we erase them. We keep the last copy of each page, to compare the next check with, while the monitor exists. Each check’s diff is deleted 30 days after the check. A dry test keeps its pages until you read it, and at most 7 days. Deleting the monitor, or your account, erases its URLs, page copies and diffs at once. Your credit ledger is separate and stays. The webhook carries each changed page’s URL, and goes only to your own signed endpoint. Monitors has the details.

A screenshot

A screenshot is a picture of the page you asked for. The browser uploads it straight to our storage, through a link that works for that one image and only for minutes. We store it under your account id and the request id, never under the page’s URL or host, and delete it 7 days after it is taken, or at once when you delete your account. Its link works for 1 hour, for anyone who holds it. Batches has the details.

Network capture

With network=true, the responses the page loaded (their URLs and bodies) pass through our memory to you, in the answer itself. We never log them, store them or put them in metrics; the audit row records only how many bytes we sent you. We read no request or response headers, no cookies and no request bodies.

Schema extraction

When you send schema, the page’s main content (as markdown, 96 KB at most), your schema and your prompt go to the model provider: Anthropic in the US. We send no account, key, user id or anything else that says who you are. Anthropic may keep what we send for a time under its own terms. Your schema, prompt, the page and the model’s answer are never written to our logs or tables; the request record keeps only the token count, the model alias and the cost. Without schema, no page content goes to any model provider.

These docs

Our sites use cookie-free, aggregate analytics. No ad trackers. Your keys, targets and requests never reach them. (Security to confirm.)

The “Open in Playground” links put the example in the part of the URL after #. Your browser never sends that part to us or to anyone else.