Privacy policy

This policy covers UsageRail: the website at usagerail.com, the console at app.usagerail.com, the customer portals we host for you and the API your servers talk to. It says what we collect, why, who processes it for us and how to have it deleted.

What we collect

When you browse usagerail.com. We use Vercel Web Analytics, which counts page views without cookies and without building a profile of you. We don't set any cookies on usagerail.com, and we don't use ad trackers.

When you use the tools. The API key generator and both calculators run in your browser. Keys you generate and numbers you type are never sent to us.

When you sign up. Your email address. If you sign in with Google or GitHub, we use the verified email address on that account to find or create your account, and don't keep anything else from it.

When you use the console. What you set up there: your apps, plans, portal branding, webhook addresses, and a log of the changes made in your account. A sign-in cookie keeps you signed in; it isn't used for anything else.

About your customers. When your customers use your portal, we store their email addresses, the keys they create (as SHA-256 hashes; the full key is shown once), their plans and their usage. The portal sets a sign-in cookie for them too. For this data you decide what happens to it, and we process it on your behalf.

Usage from your API. The SDK sends us counts grouped by customer, method plus route, outcome and minute. It doesn't send us request or response bodies, IP addresses or raw API keys. Routes are usually templates such as /users/:id. In some Express setups, the path a router is mounted on is recorded as requested, such as /tenants/42, so keep personal data out of those paths. If you use the HTTP check instead of an SDK, your server sends the API key with each check, and we use it to look the key up.

IP addresses. Our servers see the IP address of each request. We use it in memory to slow down repeated sign-in attempts and failed key checks, and don't save it.

What we use it for

To run UsageRail: signing you and your customers in, enforcing keys and limits, showing usage, and sending the emails the service needs, such as sign-in codes and quota alerts. We don't sell or rent any of this data, and we don't use your customers' data to market to them.

Who processes it for us

• Vercel hosts the website, the console and the portals, and runs Web Analytics.
• Tencent Cloud runs our servers and database in Ashburn, Virginia, in the United States.
• Cloudflare runs DNS for our domains and stores our database backups in R2.
• Resend sends our emails.
• Google and GitHub, only when you or your customers choose to sign in with them.

How long we keep it

Account data stays while your account is open. We keep minute-level usage for 45 days. Hourly usage is kept for 7 days on Free, 30 on Starter, 90 on Growth and 365 on Scale. Usage totals for each billing period and the log of changes in your account are kept for 13 months. Webhook events, delivery records and records of the emails we send are kept for 30 days.

When you delete your account, we delete its data. Copies in database backups are removed as the backups expire.

Your choices

Email support@usagerail.com from your account's address to see what we hold, correct it or delete it. We'll answer within 30 days. Your customers should contact you first; if they write to us, we'll pass the request on to you. If you're in the EU, the UK or a similar jurisdiction, you can also complain to your local data protection authority.

If you need a data processing agreement for your customers' data, email support@usagerail.com.

Changes

If we change this policy, we'll update the date above. If a change affects how we use your data, we'll tell you by email first.