Privacy policy. What we keep, and for how long.

1Who we are

ShipmentTrackingAPI (“we”, “us”) runs the website at shipmenttrackingapi.com, the API at api.shipmenttrackingapi.com and the console at console.shipmenttrackingapi.com. In this policy they are “the Service”. Questions and requests about your information go to help@shipmenttrackingapi.com.

2What we collect

Visiting the website. The website sets no cookies and runs no analytics, advertising or third-party scripts. Its fonts come from our own domain. Our hosting provider receives your IP address and browser details in order to send you the pages. We have not turned on request logs for the website, so we keep no record of your visits.

Trying the Playground without a key. The carrier and tracking number you send go to the API, as described under Tracking numbers. We record your IP address with a count of that day’s keyless lookups and attempts, and add each lookup to that address’s monthly count. This is how the free limits work without an account.

Signing in to the console. You sign in with Google, through our sign-in provider, Firebase Authentication. Google shares your email address, name and profile picture with it, and Firebase Authentication keeps them with a user ID and when you signed up and last signed in. When you create an API key, we also store your email address, your user ID and the list of your keys in our database.

Calling the API with a key. For each API key we store a SHA-256 hash of the key and its first 12 characters, never the full key, along with its name, its limits and when it was created. For each account we count lookups by month. For each IP address that calls the API we count lookups by month and note which keys made them. An IPv6 address is counted by the /64 network it belongs to.

Server logs. Our servers log each API request: the time, the address requested, the response code, the user agent your client sends and the IP address the request came from. When something fails, the error log can also contain an IP address, an account’s user ID or a tracking number.

3Tracking numbers

We do not store the tracking numbers you send, or their results, in our database. To answer a lookup, we pass the carrier and the tracking numbers to the tracking systems we use, and nothing else: not your account, your API key or your IP address. Those systems ask the carrier’s public tracking website. On the way, the request can pass through third-party network services such as proxies.

The tracking systems keep a record of each tracking number looked up and its result, and keep recent results to answer repeat lookups. These records have no set deletion date. They do not include your account, your API key or your IP address. The tracking systems and network services may operate outside the United States.

A carrier’s answer can include details of a shipment, such as the places it passed through and notes about its delivery.

4How we use it

We use the information above to:

• run the Service: answer lookups, and show your keys and usage in the console;
• enforce the free limits for each account, each IP address and the keyless Playground, including stopping one person from using many accounts;
• keep the Service secure, and look into abuse and failures;
• contact you about your account, for example about a problem with your key or a change to our terms.

We do not sell or rent personal information, use it for advertising, or let anyone use it for their own marketing.

5Who else handles it

• Google, through Firebase and Google Cloud, hosts the website, runs the API and the console’s sign-in, stores our database and keeps our logs. Our database and the API run in the United States. If you use the Service from another country, your information is transferred there.
• Google sign-in handles your Google account under Google’s own privacy policy.
• The tracking systems, network services and carrier websites described under Tracking numbers receive the carrier and the tracking numbers, nothing else.
• Authorities, when the law requires us to disclose information.

We do not give your information to anyone else.

6How long we keep it

Deleting means deleting from our database and from our sign-in provider. Google, which runs both, says it then clears deleted data from its own systems and backups within about 180 days.

7Cookies and your browser

The website, the API and the console set no cookies of their own. Signing in to the console opens a window from Firebase Authentication and Google, which may set their own cookies under their own policies.

The Playground saves the last carrier and tracking numbers you sent in your browser’s local storage, under the name sta:last-lookup, so that it can fill them in next time. That copy stays on your device. An API key you paste into the Playground stays in the open tab’s memory and is never saved.

The console keeps you signed in by storing your sign-in session in your browser’s storage (IndexedDB), through Firebase Authentication.

We do not track you across other websites, so a Do Not Track signal from your browser changes nothing here.

8Your choices

• Delete your API key at any time in the console.
• Delete your account at any time in the console, under Account. That deletes the account, its keys, its lookup counts for earlier months and your sign-in record right away. A key that was in use can keep working for up to a minute.
• Two things stay for a while after an account is deleted. If the account has had an API key, we keep its lookup count for the current month until the month ends, under its user ID, with a one-way hash of its Google account ID and the time it was deleted. A new account opened with the same Google account carries on from that count, so deleting an account does not reset the monthly limit. We also keep, for a short time, a marker that holds only the deleted account’s user ID and the time it was deleted, so that a session left open in another tab cannot bring the account back. Both, along with the counts kept by IP address and server logs, are deleted on the schedule above.
• If you cannot sign in, email help@shipmenttrackingapi.com from the address on the account and we will delete the account within 30 days.
• Ask us for a copy of the personal information we hold about you, or ask us to correct or delete it, by email. Depending on where you live, the law may give you further rights, such as objecting to how we use your information. We honor them.
• Clear this site’s data in your browser to remove the Playground’s last lookup.

9Security

We store API keys only as hashes. All traffic to the Service uses HTTPS. Browsers cannot read or write our database directly; only our servers can. No system is completely secure, so we cannot promise that information will never be accessed without permission.

10Children

The Service is meant for developers and businesses. It is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, email us and we will delete it.

11Changes

When this policy changes, we post the new version on this page and change the effective date at the top.

12Contact

Email help@shipmenttrackingapi.com with any question or request about your information. ShipmentTrackingAPI is responsible for the information described in this policy.