Privacy policy

Last updated October 14, 2026. API Meter is operated by Canada Site Ops, Ontario, Canada. Contact: canada.site.ops@gmail.com.

API Meter is in early access (beta). This page explains, in plain language, what we collect and why. We aim to handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Traffic that passes through the proxy

When you send requests to your API through the API Meter proxy, we forward each request to your origin and stream the response back. For each request we record one small usage event:

• your API's slug and internal IDs, and a request ID
• timestamp, HTTP method, and the endpoint path normalized to a pattern (for example /orders/123 becomes /orders/:id)
• response status code and latency
• request and response size in bytes
• the caller's country as a two-letter code, as reported by Cloudflare
• a customer ID and plan, if your origin sends X-MSA-Customer-Id / X-MSA-Plan response headers or the request carries x-customer-id / x-customer-plan. We remove the X-MSA-* response headers before the response reaches your client.

What we don't store: request or response bodies, request headers, query strings, or caller IP addresses. Bodies pass through to your origin and back without being saved.

What we hash: if no customer ID is supplied, we derive one from the API key (x-api-key or a Bearer token) using a keyed hash (HMAC-SHA-256) with a salt unique to your API, and store only the hash. Customer IDs that look like email addresses are hashed the same way.

You decide what customer IDs you send us. Please use pseudonymous IDs (like cus_42) rather than names.

2. Signing up

When you sign up we keep your API name, your origin URL and a SHA-256 hash of your email address, not the address itself. Your dashboard and ingest keys are stored only as hashes, so we can't show them to you again. To limit abuse, signup and verification use a hash of your IP address that expires within two hours. We don't keep raw IP addresses.

Because we only hold a hash of your email, we can't email you. We don't send marketing email or newsletters.

3. How long we keep data

• Usage events: automatically deleted after 7 days during early access.
• Rate-limit records: expire within two hours.
• Your API configuration and hashed account record: kept while your API is set up. Email us to delete it.

4. Website analytics

This website uses Google Analytics 4 to count page views and signups and see which pages are useful. Google may set cookies and process your IP address and browser details under its own terms. You can block it with a browser extension or Google's opt-out add-on. Google Search Console tells us how the site appears in search; it doesn't give us information about individual visitors.

5. Who processes the data

API Meter runs on Cloudflare (Workers, Pages and Workers KV), which processes the proxied traffic and stores the data above on our behalf. Cloudflare operates a global network, so data may be processed and stored outside Canada, including in the United States. Website analytics are processed by Google. We don't sell personal information or share it with advertisers.

6. Your choices

You can ask what we hold about your API, ask for corrections, or ask us to delete your API and its data by emailing canada.site.ops@gmail.com with your slug. If you're not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

7. Changes

We'll update this page if what we collect changes, and change the date at the top.

See also: Terms of use · Docs: what we store