Privacy Policy

This Privacy Policy explains what data Apider collects, how it is used, and how it is protected. Apider is a developer tool — we collect the minimum data necessary to provide the Service.

Short version: Your third-party credentials (Telegram tokens, email passwords, API keys) never leave your machine unencrypted. We do not sell your data. We do not run ads.

1. Data We Collect

Data	Why	Where stored
Email address	Account ID, plan tracking, billing	Azure Table Storage (`apiderusers`)
Execution count	Enforce plan limits and overage	Azure Table Storage (`apiderusers`)
Execution logs	Debugging — function name, duration, errors	Azure Table Storage (`apiderlogs`)
Webhook registrations	Dispatch external events to your functions	Azure Table Storage (`apiderwebhooks`), Fernet-encrypted env
Scheduled jobs	Execute CloudScheduler functions on timer	Azure Table Storage (`apiderschedules`), Fernet-encrypted env
Payment data	Subscription and billing	Handled exclusively by Paddle — we never see card numbers

2. Your Third-Party Credentials

Credentials in your .env file (API tokens, email passwords, webhook URLs) are treated with the following guarantees:

Encrypted in transit: Every SDK request encrypts your credentials with Fernet (AES-128-CBC + HMAC-SHA256) before sending over HTTPS — double-encrypted.
In-memory only: On Azure, credentials are decrypted via Python's ContextVar, used for the duration of your request, and immediately discarded. Never written to disk or logged.
Encrypted at rest: Webhooks and CloudScheduler persist your environment Fernet-encrypted. The key is your APIDER_ENCRYPTION_KEY — we do not hold a copy.
Never sold, never shared: Your credentials are not accessed by Apider staff unless you explicitly share them in a support request.

3. Execution Logs

When modules execute (e.g., Telegram.send, Email.read), we log the function name, execution duration, and any error message. We do not log the content of messages sent, emails read, or data written to Sheets. Logs are scoped to your user ID and visible only to you.

4. Third-Party Services

Apider relies on the following sub-processors:

Microsoft Azure — cloud execution runtime and storage. Azure Privacy →
Paddle — payment processing and Merchant of Record. Paddle Privacy →

We do not use analytics trackers, advertising networks, or any other third-party data processors beyond the above.

5. Cookies

The Apider website and management dashboard do not use tracking cookies. The dashboard is a stateless HTML page that communicates directly with the Azure Functions API using your function key.

6. Data Retention

Execution logs: retained indefinitely (up to 100 entries per user). Clearable on request.
User account data: retained while your account is active. Deleted within 30 days of account closure request.
Webhook and Scheduler data: deleted immediately when you cancel the webhook or job.

7. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, or delete personal data we hold about you. Email us at frostcore@jafa.dev with the subject "Privacy Request." We will respond within 30 days.

8. Changes to This Policy

We may update this policy as the Service evolves. Material changes will be communicated via email. The date at the top reflects the most recent revision.

9. Contact

Privacy questions or requests: frostcore@jafa.dev