Privacy Policy - Mars Vista API

Overview

Mars Vista API ("we", "our", or "the Service") provides access to Mars rover imagery. This privacy policy explains how we collect, use, and protect your personal information when you use our website and API.

We are committed to protecting your privacy and being transparent about our data practices. We collect only the minimum data necessary to provide our service.

Information We Collect

Account Information

Email address: Required for authentication via magic link sign-in
Account creation date: When you first signed up

API Key Information

API key hash: A one-way hash of your API key (we cannot retrieve your actual key)
Key metadata: Creation date, last used date, active status

Usage Data

Rate limit counters: Hourly and daily request counts per API key (stored temporarily in Redis)
Request timestamps: When API requests are made (for rate limiting only)

Technical Data

Session cookies: Used to maintain your logged-in state on the website
Server logs: May temporarily include IP addresses for security and debugging (automatically deleted)

How We Use Your Information

Authentication: To verify your identity and provide secure access to your account
API access: To validate your API key and authorize requests
Rate limiting: To enforce fair usage limits and prevent abuse
Service communication: To send magic link sign-in emails (transactional only)
Security: To detect and prevent unauthorized access or abuse

What We Don't Do

We do not sell your personal information to third parties
We do not use your data for advertising or marketing
We do not track your activity across other websites
We do not share your email with other users
We do not send promotional emails (only transactional authentication emails)

Cookies

We use only essential cookies required for the website to function:

Session cookie: Maintains your logged-in state (expires when you sign out or after inactivity)
CSRF token: Protects against cross-site request forgery attacks

We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.

Data Retention

Account data: Retained while your account is active, deleted upon account deletion
API key data: Retained while your account is active, deleted upon account deletion
Rate limit data: Automatically expires after 24 hours
Server logs: Automatically deleted after 30 days

Third-Party Services

We use the following third-party services to operate Mars Vista API:

Resend: Email delivery for magic link authentication (Privacy Policy)
Railway: Cloud hosting infrastructure (Privacy Policy)
Vercel: Website hosting (Privacy Policy)

Your Rights

You have the following rights regarding your personal data:

Access: Request a copy of your personal data
Correction: Request correction of inaccurate data
Deletion: Delete your account and all associated data from your account settings
Export: Request an export of your data in a portable format
Withdraw consent: Stop using the service at any time

To exercise these rights, please contact us at the email address below or use the account deletion feature in your dashboard.

International Users

Mars Vista API is operated from Germany. If you are accessing our service from the European Union, European Economic Area, or other regions with data protection laws, your personal data may be transferred to and processed in countries outside your region.

For EU/EEA users: We process your data under the legal basis of contract performance (providing the service you signed up for) and legitimate interests (security and abuse prevention). You have rights under GDPR including access, rectification, erasure, and data portability.

Security

We implement appropriate technical and organizational measures to protect your personal data, including:

API keys are stored as SHA-256 hashes (we cannot retrieve your actual key)
All data is transmitted over HTTPS/TLS encryption
Database access is restricted and authenticated
Regular security updates and monitoring

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

Contact Us

If you have questions about this privacy policy or your personal data, please contact us:

GitHub: Open an issue
Website: langridge.dev