Privacy Policy

• Account. Your name, email address and a password. The sign-in provider holds the password, and we never see it in plain text.
• API keys. The name you give a key, its first characters and a hash of the secret. We cannot show a secret again after it is created.
• Usage. Request counts per account and whether your account has made a first successful call, which we use to enforce limits and improve the product.
• API request log. For each API call we record the time, method, path, query parameters, status, error type, rows returned, response time, the caller's user agent and the first characters of the API key, which ties the call to your account. We use it to see how the API is used, fix what is broken and stop abuse. We remove email addresses, phone numbers, API keys and access tokens we recognize from these fields before storing them, and we drop the values of parameters named for credentials or contact details and of any task description. This is automatic and cannot catch everything, so please do not put personal details in a URL. We do not record IP addresses or request and response bodies here. We keep each entry for up to 35 days, and for less if volume is very high.
• Onboarding. What you tell us you want to build, if you answer.
• Agent requests. If your agent asks for a key, what it says you want and its name, until you approve or the request expires. If an agent or your code sends a task description with a request, we keep that text for 35 days to decide what to build. Sending one is optional.
• Feedback. What you or your agent send us through the feedback endpoint, and your account if a key is included.
• Delivery settings. Webhook addresses you add, if your plan includes them.
• Billing. Stripe handles payment, so we do not receive or store card numbers. We keep your Stripe customer and subscription identifiers, your plan and billing status, any plan we grant your account, and a record of your invoices, refunds and disputes: amounts, currency, status, dates, payment attempts and the reason Stripe reports.
• Site analytics. Page views with a random visit identifier held in your browser for that session, the referring site and any campaign tags in the link. It is not linked to your account. We also use Vercel Analytics for aggregate traffic.
• Hosting logs. Our hosting provider records IP addresses and request details, as web hosts do. We do not store IP addresses in our own tables. To limit page views, keyless signups and feedback we store a one-way hash of the address, which changes every day and cannot be turned back into it.
• Support. Whatever you send us by email.

• To run your account, authenticate API calls and apply plan limits.
• To bill paid plans and handle renewals and cancellations.
• To see which pages and features are used, and fix what is broken.
• To answer you, and to keep the Service secure.

We send account email such as password resets. We also send one activation email to an account that created a first API key and has not yet had a call return rows, with a first call to try. It is sent at most once, and you can ask us not to send it by writing to support@draftkingsapi.com. We do not sell or rent your address.

We use these providers to run the Service, and share only what each one needs:

• Vercel: website and API hosting, and aggregate analytics.
• Neon: account sign-in.
• Google Cloud: database and backups.
• Stripe: payments and the billing portal.
• Resend: sending and receiving email.

We may also disclose information if the law requires it, or if the business is sold or reorganized.

Sign-in uses cookies that keep you signed in. Site analytics uses session storage for the visit identifier described above. We do not use advertising cookies.

We keep account data while your account exists, and API request log entries for up to 35 days. To delete your account and the personal data tied to it, or to ask for a copy or a correction, write to support@draftkingsapi.com from the address on the account. We may keep what we need for tax, billing, security or legal reasons, and backups age out over time.

DD Inc. is a United States company and the providers above may process data in the United States and other countries. Using the Service means your information is handled there.

The Service is for adults. We do not knowingly collect information from anyone under 18.

We may update this policy. The effective date above changes when we do, and we will email account holders about a material change.