# Privacy Policy

Legal

What personal data we collect about our customers and website visitors, what we process about the people whose public posts the API returns, who helps us run the service, how long we keep data, and your rights.

In short

- We collect what we need to run your account: your email address, how you sign in, your API keys (as hashes), your usage, your payments (through Stripe; we never see card numbers) and security events.
- We don't sell personal data, we don't show ads, we don't send marketing email without your opt-in, and the website has no analytics or advertising cookies.
- The API returns only public data that anyone can see without logging in. We don't build profiles of the people in it and we don't sell data about them.
- You can ask to see, correct or delete your data at any time.
- This summary is for convenience only; the sections below are the policy.

## 1. Who we are and what this policy covers

SocialTap (https://socialtap.dev) is offered by Divergent Ventures LLC ("we", "us"), a company based in the United States. This policy covers two groups of people:

- **Our customers and visitors:** people who create an account, use the API, the dashboard or the website, or contact us. For their data, we are the controller.
- **People whose public data the API returns:** the authors of the public ads, albums, comments, communities, downloads, effects, embeds, engagement stats, events, hashtags, livestreams, offers, places, playlists, podcasts, posts, products, profiles, reviews, sounds, suggestions, topics, transcripts, trends, usernames, web pages and web results our customers request from Amazon, Apple Music, Bluesky, Facebook, Facebook Ad Library, Facebook Marketplace, Facebook Events, Google Ads Transparency Center, Instagram, Kick, Komi, Kwai, Lnk.Bio, LinkedIn, LinkedIn Ad Library, Linkme, Linktree, Pillar, Pinterest, Reddit, Rumble, Snapchat, SoundCloud, Spotify, Telegram, Threads, TikTok, TikTok Ad Library, TikTok Shop, Truth Social, Twitch, X and YouTube. The section "People whose public data the API returns" is about you.

The [Terms of Service](https://socialtap.dev/terms/index.md) govern the use of the service. The service is for businesses and developers aged 18 or over.

## 2. Your account

- **Email address.** The address you sign up with, used to sign you in and to send you account email. To grant free credits once per mailbox, we also store a normalized form of the address (lowercase, without a `+tag`, and without dots for Gmail addresses).
- **How you sign in.** You can sign in with Google, GitHub, or an email address and password. From Google and GitHub we receive your verified email address, your name, the link to your profile picture and your account ID there, and we store the sign-in tokens they give us, encrypted; we ask for nothing else of those accounts and never receive your password there. A password you set with us is stored only as a salted hash: nobody, including us, can read it. When you choose a password, we check it against the Pwned Passwords list of breached passwords; only the first five characters of a hash of it are sent, never the password or your email address. If you turn on two-factor authentication, we store its secret and your backup codes, encrypted, to check the codes you enter.
- **Security events.** Every sign-in, failed sign-in, password, email, two-factor and session change, with the network it came from (your IPv4 address, or the first half of your IPv6 address) and your browser's user agent. You can see them on your dashboard's security page. They are kept 90 days.
- **Dashboard session.** A random secret in a secure, HttpOnly cookie that only this site can read. We store only a hash of it. The session record also stores the IP address and the browser's user agent it was signed in from, which you can see on your dashboard's security page. It expires on its own, and signing out ends it.
- **API keys.** Each key's name, mode, scopes, spend limit, expiry, IP allowlist, when it was created and when it was last used. We store a hash of the key and its first characters for display, never the key itself.
- **AI agents asking for a key.** When an AI agent asks for a key for you, we store its request until you approve or deny it or it expires, and delete it about a day after that: the name the agent gives, the key name it asks for, the network and approximate location it asked from (shown to you on the approval page), and hashes of its codes. An MCP client's registration (its name and where it returns you after approval) holds no personal data; one never used is deleted after a day. An agent that signs up with your email address leaves your address, its name and a single-use confirmation link (as a hash) until you confirm.

## 3. Usage, billing and requests

- **Credits.** Every change to your balance: free credits, purchases, usage (hourly), refunds, disputes and manual adjustments, with the balance after each.
- **Usage.** Hourly totals per key, endpoint and outcome: requests, cache hits and credits.
- **Payments.** Stripe processes every payment on its own checkout page, under its own privacy policy. You give Stripe your card details, your billing address and, if you buy for a business, its name and tax ID; Stripe calculates sales tax from the address (Stripe Tax) and keeps your card saved for your monthly plan and auto top-up. We never receive or store your card number. We give Stripe your account's email address to fill in at checkout, and keep the checkout session, payment, invoice, subscription and Stripe customer IDs, your plan and when it renews, the amount and its currency, and the credits bought, so a refund or dispute can be matched to its purchase and your next checkout reuses your Stripe customer. Stripe keeps the tax records of each sale (the address it used and the tax charged), which we must keep for as long as tax law requires.
- **Request metadata.** For each API request we record, for operations and billing: the endpoint, your account, the outcome and HTTP status, latency, the credits charged, whether the cache answered, how the request arrived (HTTP, MCP or a job), and the request IDs you choose to send. We don't record your IP address, the parameters you sent or the response in this telemetry.
- **Request log.** So you can find and repeat a request, your dashboard keeps each request's endpoint, the parameters you sent, the key, status, outcome, credits and latency, for 30 days. It keeps the responses we sent you only if you turn that on (Settings, off by default), each for 7 days and at most 1 MB of it.
- **Jobs, webhooks and retries.** If you use them: the metadata you attach to a job and its results (kept 7 days after the job ends; the job's record 30 days), the webhook URLs you register, each delivery with a short excerpt of your server's answer, and your account's events (kept 30 days), and the responses of requests you send with an idempotency key (kept 1 day).

## 4. Abuse prevention and the website

- **IP addresses.** To stop abuse we count signups, failed key lookups and requests to free routes per IP address (per /64 network for IPv6). Signup counters are deleted within two days; the others are counters at Cloudflare that expire within minutes.
- **Signup checks.** We check that your email domain can receive mail (a DNS lookup of the domain only, through Cloudflare), refuse disposable email domains, and, on the sign-up, sign-in and password pages, may use Cloudflare Turnstile to tell people from bots.
- **Docs feedback.** If you answer "Was this page helpful?", we record the page, your answer, your comment, whether an AI agent sent it, and the country Cloudflare places the request in. Nothing that identifies your account.
- **Operational logs.** Our servers log errors and unusual events to find and fix problems. These logs, kept by Cloudflare for 7 days, can include a request's IP address and technical details such as its path and user agent. We never log API keys, passwords or the tokens in emailed links.
- **Email.** We send email only about your account and the service you use: verification and password reset links, security notices, agent signup confirmations, receipts and billing notices, invitations to an account, and the alerts you turn on. We don't send marketing email. If we ever do, it will be only to people who opt in, with a way to unsubscribe in every message.

### Cookies and storage in your browser

The site sets cookies only to sign you in. It has no analytics, advertising or tracking cookies, and no third-party trackers. Every cookie is secure and limited to this site:

| Cookie | When | Why |
| --- | --- | --- |
| Session | After you sign in | Keeps you signed in (described above) |
| Signed-in hint | While you are signed in | Tells the pages you're signed in; it holds no secret |
| Sign-in steps | During a step, briefly | Hold a step in progress, such as an emailed link or a two-factor code |

The pages also store a few preferences in your browser, which never leave it:

| What | Where | Why |
| --- | --- | --- |
| Light or dark theme | local storage | Remembers the theme you picked |
| Code example language | local storage | Shows the docs' examples in the language you picked |
| Recent searches | local storage | Lists your last few docs searches |
| Docs feedback sent | session storage | Hides the feedback form once you've answered |

The interactive API reference page loads its viewer from the jsDelivr CDN, which receives your IP address when you open that page. The sign-up, sign-in and password pages load Cloudflare Turnstile when it is turned on. We neither sell nor share personal information, so a Global Privacy Control signal has nothing to switch off.

## 5. How we use personal data, and why we may

We use it to provide and secure the service: to sign you in, run and bill your requests, show you your usage, send account email, prevent fraud and abuse, measure and improve performance and cost, answer support requests, and meet legal obligations. We don't sell personal data, we don't share it for advertising, and we don't use it to build profiles of you.

Where the GDPR or the UK GDPR applies, our legal bases are:

| Use | Legal basis |
| --- | --- |
| Your account, sign-in, requests, billing, account email and support | Performing our contract with you |
| Security events, abuse and fraud prevention, operational logs, improving the service | Our legitimate interests in a secure, reliable service |
| Purchase, invoice and tax records | Our legal obligations |
| Marketing email, if we ever send it | Your consent, which you can withdraw at any time |

## 6. Who we share it with

We use these service providers (subprocessors). Each processes data only to provide its service to us:

| Provider | What it does for us | Data it handles |
| --- | --- | --- |
| Cloudflare | Hosts the website, the API and the engine (Workers, Containers), stores account data (D1, Durable Objects, R2, Queues), sends email, runs Turnstile, telemetry (Analytics Engine), speech-to-text of public videos (Workers AI) and renders of public pages (Browser Rendering) | Everything in this policy |
| Stripe | Payments, sales tax calculation (Stripe Tax), receipts, the card saved for your plan and auto top-up | Your payment details, billing address and any business tax ID, which you give Stripe directly; your email address, your account ID and what you buy |
| Evomi | Proxy network for our requests to the platforms | The public addresses we fetch. Never your account data |
| Brave Search, DuckDuckGo | Web searches for the endpoints that find items through a search engine | The search terms of those requests. Never your account data |
| Google, GitHub | Sign-in, if you choose it | What you approve on their consent screen |
| Have I Been Pwned (Pwned Passwords) | Breached-password check | Five characters of a password hash, nothing else |

**People on the same account.** When you invite someone to your account, or join someone else's, the people on that account see each other's email addresses and roles, and the account's data as their roles allow (usage, the activity log, keys' names, billing). An invitation is emailed to the address you enter, with your email address and the account owner's in it.

We also disclose data when the law requires it, to protect our rights or the safety of others, or as part of a merger, acquisition or sale of assets, under this policy's protections.

This list is kept current: we add a new provider here before it handles our customers' personal data, and the date at the bottom of this page changes with it. A material change is announced as "Changes to this policy" says.

## 7. How long we keep it

| Data | Kept |
| --- | --- |
| Account, keys, credit ledger, usage totals, purchases | While your account exists, then as the deletion rules below say |
| Security events | 90 days |
| Job results | 7 days after the job ends |
| Job records | 30 days after the job ends |
| Account events and webhook deliveries | 30 days |
| Idempotent responses | 1 day |
| Request log | 30 days |
| Responses kept for your request log (only when you turn it on) | 7 days |
| Signup, sign-in and email counters (they name an address or a network) | Deleted within two days |
| An AI agent's request for a key | About a day after it is decided or expires |
| Operational logs | 7 days |
| Request telemetry (account and key IDs, never your email) | 3 months |
| A deleted account's purchases and credit ledger, with no name or email address | 7 years after the deletion |
| Whether an email address has had free credits, as a hash of the address | As long as the deleted account's ledger |

When an account is deleted, we keep its purchase and credit ledger records for 7 years after the deletion, for tax and accounting, without your name or email address: the account's ID, what was bought and when (with Stripe's IDs for each payment), and how the balance changed. Stripe keeps its own record of the charges and invoices, with the details you gave it. We also keep a hash (SHA-256) of the address that got the account's free credits, so that deleting an account and signing up again doesn't grant them twice; it identifies the address only to someone who already knows it. Then those go too.

## 8. Your rights

Wherever you live, you can ask us to:

- **access** your data: much of it is in your [dashboard](https://socialtap.dev/dashboard/) and the account API (your account, keys, usage, balance changes and events), and we'll send the rest on request;
- **correct** it, such as your email address;
- **delete** it, along with your account;
- give you a **copy** in a portable format;
- **object to** or **restrict** a use of it;
- **withdraw** a consent you gave, at any time.

Residents of the EU, the UK, California and other places with privacy laws have these rights by law, and may also complain to their data protection authority. We don't sell or share personal information for cross-context advertising, and we won't treat you differently for using your rights. Send requests to [support@socialtap.dev](mailto:support@socialtap.dev); we answer within the time the law requires, after confirming the request comes from you. You may use an authorized agent where the law allows; we may ask for proof of its authority.

**Deleting your account.** The account's owner can delete it in the [security settings](https://socialtap.dev/security/), after confirming it's them (their password or, when it's on, their two-factor code; or signing in again with Google or GitHub). At once, every API key is revoked, every session is signed out, and the account's jobs and webhooks stop. For 7 days you can change your mind: signing in again cancels the deletion (the old keys stay revoked). Then the account is deleted for good: its owner's sign-in methods and security log (unless the owner also belongs to another account), everyone else's access to it, its keys, usage, request log (with any responses it kept), jobs and their results, webhook endpoints and events. Its unspent credits are forfeited, and its customer record at Stripe, if it has one, is deleted. What we keep afterwards, and for how long, is in "How long we keep it" above; request telemetry and our logs expire on their own schedules. Our backups keep earlier states for at most 30 days, so the deleted data leaves them within 30 days of the deletion. We don't offer a self-serve export: to get a copy of your data, write to [support@socialtap.dev](mailto:support@socialtap.dev).

## 9. People whose public data the API returns

The API returns public ads, albums, comments, communities, downloads, effects, embeds, engagement stats, events, hashtags, livestreams, offers, places, playlists, podcasts, posts, products, profiles, reviews, sounds, suggestions, topics, transcripts, trends, usernames, web pages and web results from Amazon, Apple Music, Bluesky, Facebook, Facebook Ad Library, Facebook Marketplace, Facebook Events, Google Ads Transparency Center, Instagram, Kick, Komi, Kwai, Lnk.Bio, LinkedIn, LinkedIn Ad Library, Linkme, Linktree, Pillar, Pinterest, Reddit, Rumble, Snapchat, SoundCloud, Spotify, Telegram, Threads, TikTok, TikTok Ad Library, TikTok Shop, Truth Social, Twitch, X and YouTube: what anyone can see on those sites without logging in. When a customer asks for an item, we fetch it from the platform, convert it to our format and return it to that customer. We never log in, use fake accounts, solve CAPTCHAs or access private, paywalled or deleted content.

What we keep: responses are cached for at most 7 days so repeated requests don't reach the platform again, and job results are kept for 7 days. A customer's request log keeps the parameters they sent, which may include a link or a handle, for 30 days, and, only if the customer turns it on, the responses we returned to them, for 7 days. We don't build profiles of the people in the data, combine it across requests to learn about them, or sell data about them.

**Who decides.** Our customers and we are each an independent controller of this data. Each customer decides what to request, why, and what to do with the result, and is responsible for having a lawful basis for that; the [Terms of Service](https://socialtap.dev/terms/index.md) require it. We decide how the service fetches public pages, the short-lived cache that avoids fetching the same page twice, and how the service is secured. Our legal basis for that is our legitimate interest in running a reliable service that returns only what is already public, with these short retention periods to keep the effect on you small.

**Your rights and objections.** You can ask us what we hold about you, ask us to delete it, or object to our processing it, by writing to [support@socialtap.dev](mailto:support@socialtap.dev) with the link to the account or item concerned. We delete what we hold about it (cached copies and job results) and, where the law requires it or we decide it is right, stop returning that account or item. Copies a customer already received are that customer's, and the customer answers for them. We can't remove anything from the platform itself: to do that, delete or hide it there, and the API stops returning it once any cached copy expires.

## 10. Security

We protect data with encryption in transit, hashing of API keys, session and link tokens and passwords, encryption of two-factor secrets, backup codes and sign-in tokens, single-use links that expire, scoped keys with optional spend limits, expiry and IP allowlists, and checks that dashboard changes come from our own site. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

## 11. International transfers

We are based in the United States, Cloudflare runs the service on its global network, and the providers that handle our customers' personal data are based in the United States, so your data is processed in the United States and may be processed in other countries too. When you use the service from outside the United States, you send your data to us there. Where our providers receive personal data from the EU, the UK or Switzerland, they protect its transfer with the European Commission's Standard Contractual Clauses (and the UK's addendum to them) or their certification under the EU-US Data Privacy Framework.

## 12. Children

The service is for businesses and developers aged 18 or over. It is not directed at children, and we don't knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to [support@socialtap.dev](mailto:support@socialtap.dev) and we will delete it.

## 13. Changes to this policy

We may update this policy. The date it takes effect is at the bottom of this page. For a material change, we email account owners at least 14 days before it takes effect.

## 14. Contact

Divergent Ventures LLC, [support@socialtap.dev](mailto:support@socialtap.dev).

**Effective November 9, 2026.** Divergent Ventures LLC offers SocialTap. Questions about this page: [support@socialtap.dev](mailto:support@socialtap.dev).

See also: [Terms of Service](https://socialtap.dev/terms/index.md).

---

[HTML version](https://socialtap.dev/privacy/) · [Docs index for AI agents](https://socialtap.dev/llms.txt) · [All docs in one file](https://socialtap.dev/llms-full.txt)