Short version: no cookies, no advertising, no third-party scripts, and your IP address is never written down. The long version is below, and it describes what the code actually does — you can read it and check.
One row per request, holding: the path (with record ids replaced, so
/v1/posts/42 becomes /v1/posts/:id), the method,
the status code, how long it took, the response size, your country and
region, whether the request looked automated, and — if you sent one — the
id of your API key.
To count how many people use the service rather than how many requests arrive, each visitor gets a hash. It is built like this, and the salt is a secret held on the server:
visitor = SHA-256(secret + your IP + your browser's user-agent) # first 8 bytes kept address = SHA-256(secret + your IP) # first 8 bytes kept
A hash cannot be turned back into an address. The two exist separately so the service can tell "ten people" from "one person with ten browser tabs" — that difference is the entire reason for the second one.
Rotating the secret invalidates every hash ever stored, which is the switch that gets pulled if anyone asks for their data to be erased.
The host of the page you came from, if any — news.ycombinator.com,
not the full address. A referrer can carry a search query or a private path
in the rest of the URL, so the rest is discarded before anything is stored.
The landing page measures how long it was visible and sends the number of seconds when you leave. It is added to a daily total per page. It is not attached to you, and time spent with the tab in the background is not counted.
POST /v1/keys stores the address you give it, so a key can be
contacted or revoked later. Nothing is sent to it — there is no mailing
list, and the key is issued immediately with no confirmation email. If you
would rather not, the anonymous tier needs no key at all.
Records written to /v1/sandbox/… are stored as given and
deleted 24 hours later. It is a mock API: do not put anything real in it.
Never written to storage. It goes into a hash and is discarded.
The site sets no cookies of any kind, which is why there is no consent banner. The admin pages keep a token in your browser's local storage, but that is only for the operator and never leaves your machine.
Country and region (state or province) only. City plus a quiet day starts to identify a person, which is exactly what the hashing exists to prevent, so it is not collected.
No analytics scripts, no fonts, no trackers, no embeds. Every page
loads only files from this domain, enforced by a content security
policy of 'self' — so nothing here can report your visit
to a third party.
| What | Kept for | Then |
|---|---|---|
| Sandbox records | 24 hours | deleted by a nightly job |
| Visitor and address hashes | 90 days | deleted |
| Per-request log | 90 days | expires automatically |
| Daily totals (no identity) | 400 days | deleted |
| API keys and their email | until you ask | deleted on request |
The service runs on Cloudflare Workers, so Cloudflare handles the traffic and — like any host — sees connections as they arrive. Their handling is governed by Cloudflare's privacy policy.
There is nobody else. Nothing is sold, shared, or sent anywhere. There is no advertising, and no third party has access to any of it.
Open an issue. In practice:
An API key and its email can be deleted outright. Do not post the address in a public issue — ask for it to be removed and a private route will be arranged. Visitor hashes cannot be looked up individually, because they are hashes and there is deliberately no way to work back from a person to one. What can be done, and will be on request, is rotating the secret, which invalidates every stored hash at once.
Everything else is either aggregate counts with no identity in them, or it has already expired on the schedule above.
For anything at all — a privacy request, a bug, an endpoint behaving oddly, or a feature you want — open an issue. It is read, and it is the fastest route to a reply.
Issues are public, so do not put an email address or anything else private in one. If your request needs something you would rather not post, say so in the issue and another route will be arranged.
flaky is free, has no paid tier, and is open source under the MIT licence. If it goes away, the code and the data generator go with you.