Short version: no cookies, no advertising, no third-party scripts, and your IP address is never written down. The long version is below, and it describes what the code actually does — you can read it and check.
One row per request, holding: the path (with record ids replaced, so
/v1/posts/42 becomes /v1/posts/:id), the method,
the status code, how long it took, the response size, your country and
region, whether the request looked automated, and — if you sent one — the
id of your API key.
To count how many people use the service rather than how many requests arrive, each visitor gets a hash. It is built like this, and the salt is a secret held on the server:
visitor = SHA-256(secret + your IP + your browser's user-agent) # first 8 bytes kept address = SHA-256(secret + your IP) # first 8 bytes kept
A hash cannot be turned back into an address. The two exist separately so the service can tell "ten people" from "one person with ten browser tabs" — that difference is the entire reason for the second one.
Rotating the secret invalidates every hash ever stored, which is the switch that gets pulled if anyone asks for their data to be erased.
The host of the page you came from, if any — news.ycombinator.com,
not the full address. A referrer can carry a search query or a private path
in the rest of the URL, so the rest is discarded before anything is stored.
The landing page measures how long it was visible and sends the number of seconds when you leave. The number of seconds is added to a daily total per page and is not attached to you. Which page you read is recorded against the visitor hash below, in the same list as the endpoints you called. Time spent with the tab in the background is not counted.
For each day you visit, the service keeps a list of the paths you touched and how many times: the pages you read and the endpoints you called, with record ids already replaced, plus whether the request asked for one of the chaos parameters and whether it returned an error. It is stored against the hash above, not against you, and it is deleted on the same 90-day clock as the hash.
It exists to answer one question — what the handful of people who come back more than once actually use — and it is only ever read for people who returned on more than one day. It is a list of paths, not a session recording: there is no ordering within a day, no timing between requests, nothing you typed, and nothing from any other site.
POST /v1/keys stores the address you give it, so a key can be
contacted or revoked later. Nothing is sent to it — there is no mailing
list, and the key is issued immediately with no confirmation email. If you
would rather not, the anonymous tier needs no key at all.
Records written to /v1/sandbox/… are stored as given and
deleted 24 hours later. It is a mock API: do not put anything real in it.
The JSON you paste is stored as given so it can be served back as endpoints, and deleted after the number of days you chose when creating it — one to nine, one if you did not say. A spec pasted into /openapiMockServer is read and not kept: what is stored is the records generated from it, deleted the same way. The country and region it was created from are stored on the same row — no city, no address, the same coarseness as everything else here. The operator can read both while they exist, in order to see what the feature is being used for.
So: it is a mock API for mock data. Do not paste anything real, and if you want a copy that nobody else can see, use the export — those files run on your own machine and are never uploaded.
Never written to storage. It goes into a hash and is discarded.
The site sets no cookies of any kind, which is why there is no consent banner. The admin pages keep a token in your browser's local storage, and a flag that leaves the operator's own visits out of the visitor counts. Both are set only on the operator's machine, never on yours.
Country and region (state or province) only. City plus a quiet day starts to identify a person, which is exactly what the hashing exists to prevent, so it is not collected.
No analytics scripts, no fonts, no trackers, no embeds. Every page
loads only files from this domain, enforced by a content security
policy of 'self' — so nothing here can report your visit
to a third party.
| What | Kept for | Then |
|---|---|---|
| Sandbox records | 24 hours | deleted by a nightly job |
| JSON pasted into /createMockServer, and records generated from a spec at /openapiMockServer | 1–9 days, as chosen | deleted by a nightly job |
| Paths used, per visitor hash | 90 days | deleted by a nightly job |
| Visitor and address hashes | 90 days | deleted |
| Per-request log | 90 days | expires automatically |
| Daily totals (no identity) | 400 days | deleted |
| API keys and their email | until you ask | deleted on request |
The service runs on Cloudflare Workers, so Cloudflare handles the traffic and — like any host — sees connections as they arrive. Their handling is governed by Cloudflare's privacy policy.
There is nobody else. Nothing is sold, shared, or sent anywhere. There is no advertising, and no third party has access to any of it.
Open an issue. In practice:
An API key and its email can be deleted outright. Do not post the address in a public issue — ask for it to be removed and a private route will be arranged. Visitor hashes cannot be looked up individually, because they are hashes and there is deliberately no way to work back from a person to one. What can be done, and will be on request, is rotating the secret, which invalidates every stored hash at once.
Everything else is either aggregate counts with no identity in them, or it has already expired on the schedule above.
For anything at all — a privacy request, a bug, an endpoint behaving oddly, or a feature you want — open an issue. It is read, and it is the fastest route to a reply.
Issues are public, so do not put an email address or anything else private in one. For anything you would rather not post — a privacy request, a key you want deleted, a security report — email flakyapi.dev@gmail.com.
flaky is free, has no paid tier, and is open source under the MIT licence. If it goes away, the code and the data generator go with you.