Privacy Policy

Last updated: October 18, 2026

Stepcheck is run by Plexsicity, who is responsible for the data described here. This policy describes what Stepcheck collects, why, and how it is handled. The short version: we collect the minimum needed to run an API with accounts and billing, we don’t sell data, and payment details never touch our servers.

What we collect

• Account data — your email address and your Plexsicity account ID, which Plexsicity Auth gives us the first time you sign in, plus your plan and notification settings. You sign in on Plexsicity Auth, so your password and passkeys stay there: Stepcheck never receives or stores them.
• API keys — a hash of each key, never the key itself, plus its first 16 characters so you can tell your keys apart, its name, and when it was created, last used and revoked.
• Usage data — a record of each successful request: the operation, the API key that made it (or that it came from the Playground), the credits charged, how long it took and when. It is used for quota enforcement, your usage dashboard and history, and abuse prevention. Failed requests are not added to your history.
• Request data — the parameters you send are processed to produce your result, which is returned to you and not stored. Your history keeps a summary of each successful request: up to 20 of its top-level fields, with text cut to the first 200 characters and nested values left out.
• Webhooks — the endpoint URLs you add, their signing secrets, and a log of delivery attempts (status code or error, and when). The events we send contain the operation, credits charged, processing time and timestamp, not your request or result.
• Teams — who belongs to which team and in what role, and the email addresses invited. A team’s owner sees its members’ email addresses; members and invitees see the owner’s, which is also in the invitation email.
• Notifications — the ones in your dashboard, such as quota alerts and new API keys.
• Billing data — handled by Stripe. When you first upgrade we create a Stripe customer with your email address; we store its customer ID, your plan and your billing period, never card numbers.
• Connection data — every request to this site and the API passes through Cloudflare and our web server, which see your IP address, the address you request and your browser or HTTP client, and may record them in access logs.

What we don’t do

• No selling or renting of personal data.
• No advertising trackers, and no third-party analytics services.
• No reading of your request history beyond what’s needed for operations, debugging, or abuse investigation.

Analytics, session recording & error reports

Each tool below runs on our own servers. Your data is not sent to Google Analytics, Hotjar, or any other third-party service.

• Page analytics (Umami). Counts page views and referrers. It sets no cookies, does not track you across sites, and does not build a profile of you. Because it collects no personal data, it runs without asking.
• Error reports (GlitchTip). When a page fails, in your browser or on our server, a report goes to our error tracker: the error, the page address, what happened just before it (such as clicks, navigation and requests) and technical details such as your browser version. The site also tells it each time you open a page, with a random ID rather than your account, so we can see how many visits run into errors.

Cookies & local storage

Your sign-in session is held in an encrypted, secure, httpOnly cookie that JavaScript can’t read, with a second, short-lived one while you sign in. If you change the theme, it is kept in local storage and a small cookie; local storage also remembers which team you’re viewing. If you turn on “Remember my request drafts” in the Playground, your drafts are kept in that tab’s session storage until you close it or sign out. We set no advertising or cross-site tracking cookies anywhere on the site.

Subprocessors

We share data only with the providers required to operate the Service, each receiving only what it needs:

• Stripe — payment processing. It receives your email address when you first upgrade; card details are handled entirely by Stripe and never reach our servers.
• Cloudflare — DNS and network protection in front of the Service. Every request to this site and the API passes through it.
• Forward Email — sends our emails (team invitations and quota alerts) and forwards mail sent to [email protected] to us.
• Plexsicity Auth (auth.plexsicity.com) — sign-in. Your Plexsicity account, with its password and passkeys, lives there.
• Our cloud hosting provider — application servers and the database.

The tools under “Analytics, session recording & error reports” are self-hosted, so what they collect is kept on our own servers, not by another company; they are not subprocessors.

Retention & deletion

We keep your account data, API keys, usage history, webhooks and their delivery logs, team memberships and invitations, and notifications for as long as your account exists; none of it expires on its own. Results are never stored. The records we use to process each request and send its webhooks are deleted about a week after they finish, and records of quota-alert emails 90 days after the alert is processed. Our nightly database backups keep the 14 most recent copies, so deleted data can remain in a backup until it rotates out.

You can’t delete your account from the dashboard. To have your account and its data deleted, email [email protected].

Your rights

You can request a copy of your data, correction, or deletion at any time via the email above. If you are in a jurisdiction with specific data-protection rights (e.g. GDPR or CCPA), we honor requests accordingly.

Changes

If this policy changes materially, we’ll post the update here with a new date.

Contact

Privacy questions: [email protected].