Privacy Policy

1. Who we are

API Partner is an API client built and operated by Shreyansh Jain ("we", "us"). It is made up of the desktop apps for macOS, Windows and Linux, the web app at api.partner.shrynshjn.com/app, the API Partner mobile apps when they are released, and the sync server at api.partner.shrynshjn.com that they all use (together, the "Service"). This policy explains what personal data the Service handles and why, in line with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.

2. End-to-end encryption

The content of your workspaces is encrypted on your device before it is sent to us, and can only be decrypted on the devices of people who are members of that workspace. This covers requests and their URLs, parameters, headers, bodies, auth settings and saved examples; folders and collections; environments and variables; scripts; and the names of workspaces, collections, folders and requests.

• Each workspace has its own data key. Content is encrypted with XChaCha20-Poly1305, and the server refuses to store anything that isn't encrypted.
• The data key is sealed to each member's public key. Your private key is stored on our server only in wrapped form — encrypted with a key derived from your Encryption Passphrase (Argon2id) and, separately, with your Recovery Key. Your passphrase and Recovery Key are never sent to us.
• Because we never hold your keys, we cannot recover your data if you lose both your Encryption Passphrase and your Recovery Key, and we cannot hand readable content to anyone, including an authority, because we don't have it.

Some information has to stay readable for sync and sharing to work. We describe it in §3 — in short, your account, your devices and sessions, workspace membership, and the shape of your encrypted data (how many items there are, their type, size, position in the tree and when they changed), but not what they contain.

3. What we collect

We collect only what the Service needs to work:

• Account details — your email address, username, first and last name, and your password, which is stored only as an Argon2id hash (or not at all if you sign in only with Google, GitHub or a passkey); your theme preference.
• Sign-in methods — if you link Google or GitHub, the provider's account identifier and verified email; passkey public keys and names; for authenticator-app MFA, the secret (encrypted with a server key) and hashes of your recovery codes; and hashed one-time codes sent to your email, which expire after 10 minutes.
• Devices and sessions — for each device you sign in on, a device identifier, a device name (such as your computer's name), the platform, and when it was last active; for each session, the IP address and user agent it started from. Only hashes of session tokens are stored.
• Encryption keys — your public key, your private key in wrapped (encrypted) form, the salt and settings used to derive your passphrase key, a check value used to validate a typed Recovery Key, and each workspace's data key sealed to each member. None of these let us decrypt your content.
• Encrypted workspace content — the ciphertext described in §2, plus the metadata needed to sync it: item IDs, types, parent and order in the tree, version numbers, sizes and timestamps.
• Workspaces and teams — the workspaces you belong to, your role in each, invitations you send or receive (including the invitee's email address), and which requests you have marked as favourites.
• Security records — rate-limit counters keyed by IP address, email or user, and server logs of API calls (time, route, status and IP address) used to keep the Service running and secure.
• Update checks — the desktop app checks api.partner.shrynshjn.com/updates/ for new versions, which tells our server its IP address and platform, like any web request.
• Messages you send us — support emails and their contents.

4. What we don't collect

• Your requests and responses. Requests are sent directly from your device — natively by the desktop app, or by your browser in the web app — to the servers you choose. They do not pass through our server, and we never see what you send or receive.
• Your history. Request history is kept only on the device that sent the request and is never synced.
• OAuth 2.0 tokens you obtain for your own APIs are kept on your device and never synced.
• Files you attach to form-data or binary bodies stay on your device; only their file path is saved in the encrypted request.
• Tracking. The desktop, web and mobile apps contain no advertising or third-party analytics SDKs and no cross-site trackers. This marketing website (shrynshjn.com) uses Google Analytics to count page visits; the apps do not.

5. How we use it

We use the data above only to:

• create and run your account and sign you in on your devices;
• store and sync your encrypted workspaces across your devices and with the members you invite;
• send service emails — sign-in and verification codes, workspace invitations, security alerts (for example, a new sign-in method or an email change) and important notices about the Service;
• keep the Service secure — rate limiting, detecting misuse, and investigating incidents;
• deliver desktop app updates; and
• operate and fix the Service and answer your support requests.

We do not sell your data, use it for advertising, or build profiles from it.

6. Shared workspaces

When you are a member of a workspace, its other members can see your name, username and email address, your role, and the content of the workspace, which they decrypt on their own devices. The workspace's owner and admins decide who is a member. If you remove a member, the server stops serving them the workspace straight away, but anything they already opened may remain on their devices.

If you add other people's personal data to a workspace — for example, test payloads containing customer details — you are responsible for having the right to do so. Because that content is end-to-end encrypted, we cannot see it or act on it.

7. Who it is shared with

We do not sell or rent data. It leaves the Service only in these cases:

• Infrastructure providers — the Service runs on Amazon Web Services servers in India and stores its database on MongoDB Atlas; email is sent through Google's Gmail service. They process data on our behalf, under their contractual terms, only to run the Service.
• Sign-in providers you choose — if you sign in with Google or GitHub, that provider learns that you signed in to API Partner, under its own privacy policy.
• Other members of your workspaces, as described in §6.
• Where you send it — the APIs you call, and the files you export or share, receive what you send them.
• Legal requirements — when we are required to by law, a court order or a lawful request from a government authority, or to protect the rights and safety of users and the Service. Workspace content would only ever be disclosed as ciphertext, because we can't decrypt it.

8. Where it is stored and how it is protected

Data is stored with the providers above, in data centres in India or other countries; they apply their own physical and encryption-at-rest protections. Within the Service:

• workspace content is end-to-end encrypted, as described in §2;
• all traffic between the apps and the server uses TLS 1.2 or 1.3 with HSTS;
• passwords are hashed with Argon2id and are never stored or logged in plain text; sign-in codes and session tokens are stored only as hashes;
• access tokens last 15 minutes; refresh tokens rotate, and reusing an old one signs that session out; you can see and sign out of every session from Settings → Security;
• sign-in and sensitive actions are rate-limited, and you can add authenticator-app MFA or passkeys; and
• the database accepts connections only from our server, over TLS.

No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify you and the authorities as the law requires. To report a vulnerability, write to the contact in §15.

9. How long we keep it

We keep your account and encrypted workspaces for as long as your account is active. Sign-in codes expire after 10 minutes and expired sessions are removed automatically. When you delete an item or a workspace, it is marked as deleted so other devices can sync the change; the encrypted copy may stay in our database until it is purged. Unverified sign-ups may be removed after 24 hours if someone else claims the same username. Server logs are kept for a limited period for security and troubleshooting.

10. Your rights

You can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong (you can change your name, email and password yourself in the app);
• erase your personal data, as described in §11;
• withdraw a consent you gave, which may mean we can no longer provide the Service; and
• nominate someone to exercise these rights on your behalf if you die or are unable to.

You can export your workspace content yourself at any time, in Postman v2.1, cURL or the native format. Send other requests to the contact in §15 from the email on your account. We will respond within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

11. Deleting your account

You can delete your account in the app: Settings → Security → Delete account, then confirm with your password (or, if you don't have one, a code we email you). You can also email shreyansh@shrynshjn.com with the subject "API Partner account deletion" from the email address on the account, and we will complete it within 30 days. When an account is deleted:

• your account, password hash, linked sign-in methods, passkeys, MFA data, sessions, devices, keys and favourites are deleted;
• workspaces that only you belong to are deleted with all their content;
• you are removed from every workspace you were a member of; and
• if you own a workspace that other people share, you'll be asked to transfer its ownership or delete it first, so your team doesn't lose its work unexpectedly.

Content you created in a workspace that continues to exist stays with that workspace. Data on your own devices — the local cache, history and keychain entries — is removed when you sign out or uninstall the app. Copies in backups are overwritten on the normal backup cycle.

12. On your device

The desktop app keeps your refresh token, private key and local database key in the operating system's keychain (macOS Keychain, Windows Credential Manager or Linux Secret Service). Its offline cache is encrypted with that local key. History, OAuth tokens and draft tabs are stored on the device only. Signing out removes your tokens and keys from the device.

The web app keeps your session in an HttpOnly, secure cookie limited to the sign-in endpoints, and its cache, history and preferences in your browser's storage. It uses no advertising cookies or cross-site trackers.

13. Children

API Partner is a developer tool for adults and is not meant for anyone under 18. We do not knowingly collect data from children; if we learn that we have, we will delete it.

14. Changes to this policy

If this policy changes, we will update the date at the top of this page and, for significant changes, tell you by email or in the app before they take effect.

15. Contact & grievances

Questions, privacy requests, security reports and grievances go to our grievance officer, Shreyansh Jain, at shreyansh@shrynshjn.com. We acknowledge grievances within 24 hours and aim to resolve them within 15 days.

See also the Terms of Use and the User Agreement.