Privacy Policy
Last updated: March 7, 2026
This Privacy Policy describes how the Satoshi API hosted service at bitcoinsapi.com ("Service") collects, uses, and protects your information. The Service is operated by Andy Barnes ("Operator", "we", "us").
1. Information We Collect
| Data | When Collected | Purpose | Retention |
|---|
| Email address | API key registration | Key management, abuse prevention | Until key deletion |
| API key hash (SHA-256) | Registration | Authentication | Until key deletion |
| IP address | Every request | Rate limiting, abuse prevention | 30 days (access logs) |
| Request path and method | Every request | Usage analytics, rate limiting | 30 days |
| HTTP status code | Every request | Error monitoring | 30 days |
2. Information We Do NOT Collect
- We do not use cookies or browser tracking.
- We do not collect personal information beyond email (for key registration) and IP addresses (for rate limiting).
- We do not store your API key in plaintext. Only the SHA-256 hash is stored.
- We do not log the content of your API requests or responses (e.g., transaction hex data you broadcast is not stored).
- We do not sell, rent, or share your data with third parties.
3. Third-Party Services
The Service uses the following third-party services:
- Cloudflare: HTTPS termination, DDoS protection, and CDN. Cloudflare may process your IP address and request headers according to their privacy policy.
- CoinGecko: Price data source. Your requests to our price endpoint do not go directly to CoinGecko; we fetch and cache data server-side.
4. How We Use Your Information
- Rate limiting: IP addresses and API key hashes are used to enforce per-minute and daily rate limits.
- Abuse prevention: Access logs help identify and block abusive behavior.
- Service improvement: Aggregate, anonymized usage data (e.g., most popular endpoints) may be used to prioritize features.
5. Data Security
- All traffic is encrypted via HTTPS (TLS, terminated at Cloudflare).
- API keys are stored as SHA-256 hashes. Plaintext keys are shown once at registration and never stored.
- The database is stored locally on the server with filesystem-level access controls.
- No passwords are collected (API keys are the only credential).
6. Data Retention
- Access logs: Pruned automatically after 30 days.
- API key records: Retained until you request deletion.
- Fee history data: Aggregate data retained for up to 90 days for the fee history endpoint.
7. Your Rights
You may request:
- Deletion of your API key and associated email by contacting us.
- Information about what data we hold about your email address.
Contact api@bitcoinsapi.com for data requests.
8. Self-Hosted Instances
This Privacy Policy applies only to the hosted service at bitcoinsapi.com. If you self-host Satoshi API, you are responsible for your own data handling practices. The open-source software does not phone home or transmit data to us.
9. Children's Privacy
The Service is not directed at children under 13. We do not knowingly collect information from children.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date.
11. Contact
For privacy questions or data requests, contact us at api@bitcoinsapi.com.