Privacy Policy

Information processed

• Account identifiers such as email address, display name, avatar, and authentication-provider identifiers.
• API keys in protected form, session information, request metadata, usage records, balances, and billing transactions.
• Prompts, reference media, generated outputs, and related task metadata when required to perform a request.
• Operational logs such as IP address, user agent, request ID, error details, and security events.
• Support communications sent to MaxAPI.

How information is used

Information is used to authenticate users, route and complete requests, calculate charges, deliver generated assets, prevent abuse, investigate incidents, provide support, and improve service reliability.

Providers and infrastructure

Requests may be processed by the model provider or route selected for the request and by infrastructure providers used for hosting, storage, email, authentication, monitoring, and payments. Their handling is governed by their own terms and privacy policies.

Registration and sign-in security

MaxAPI uses Cloudflare Turnstile to check registration and sign-in requests, including third-party sign-in. Cloudflare processes connection and browser signals needed for this anti-abuse check. Passwords, prompts, API keys and payment details are not sent to Turnstile by MaxAPI. This security check is separate from optional website analytics.

Third-party sign-in uses a short-lived, HttpOnly security cookie to bind a verified attempt to the same browser. Free-trial fraud prevention also uses a signed device cookie and keyed hashes of Google identity, normalized Gmail address and IP subnet to enforce account and network allowances. These security identifiers are not advertising identifiers.

Cloudflare Turnstile privacy information

Saved conversations

When you use the language-model playground while signed in, conversation messages, drafts, titles and model settings are saved to your account so you can continue on another device. Saving history does not send a new generation request. Conversations remain until you delete them; deleting removes their content from active history storage and keeps a minimal deletion marker to prevent older devices restoring it.

Unsynced changes may be stored in this browser until the account confirms saving. Existing browser-only history is imported when you next open it while signed in. Offline copies on another device may remain there until that device reconnects; conflicting edits are kept separate rather than silently overwriting account history.

Retention and security

Generated media is normally retained for three days unless a different delivery path or operational requirement applies. Account, billing, fraud-prevention, support, and security records may be retained longer when needed to operate the service, resolve disputes, or meet legal obligations.

MaxAPI applies access controls and operational safeguards, but no internet service can guarantee absolute security. Users must keep API keys and sessions confidential.

Optional public website analytics

With your consent, MaxAPI uses Google Analytics on known public website pages to measure page visits and clicks to begin using the service. It is not installed in Console or Admin. The tag is not loaded before consent, and refusing analytics does not affect authentication, API requests, generation, or payment. You can change your choice through Privacy choices at the bottom of public pages. Browser Do Not Track and Global Privacy Control signals also disable this collection.

Events contain a known public page path, language, page category and a limited referral-source category. URL query strings, fragments, prompts, images, API keys, account identifiers and payment details are not sent in these events. Google receives the technical connection and device data needed to process analytics, and uses a pseudonymous analytics cookie; this is not a claim that analytics is anonymous. Advertising personalization, Google signals and automatic form/search tracking are disabled.

Your consent choice and analytics cookies expire after at most 30 days. Event and user-level data retention in this GA4 property is set to two months; aggregate reports can have different retention. Analytics is optional, does not prove registration or payment, and is not used to link an account or an API request to an advertising identity.

How Google uses information from sites that use its services

Optional first-party attribution

Separately from Google Analytics, you may allow MaxAPI to associate approved source, medium and campaign labels, a public landing-page category and language with your newly verified account, its first successful API call and first settled credit purchase. We use this association to measure which sources help people start using MaxAPI. This is an account-linked first-party record, not anonymous analytics, and it is not sent to Google Analytics. Existing accounts are not retrospectively attributed.

Only allowlisted labels are retained for the first source and the last non-direct source. This attribution record does not contain full URLs, arbitrary query values, advertising click IDs, IP addresses, device fingerprints, prompts, images or API keys. Unknown sources and cross-device or separate-domain gaps are not reconstructed.

Attribution requires its own affirmative choice. Accepting website analytics or the service terms does not grant this permission. Use the Source attribution option within Privacy choices on public pages or in Console to allow, reject or withdraw it; Do Not Track and Global Privacy Control disable collection. Refusing or withdrawing does not affect login, API calls, generation or payment.

Attribution expires 30 days after consent, without renewal from ordinary visits. Expired records are excluded from reports immediately; browser data is cleared on the next visit and server data by scheduled batch cleanup, which can be delayed by downtime or a backlog. After account association, raw source labels are removed from the browser, leaving the choice and a withdrawal receipt. Withdrawal clears server-side source fields while a minimal account-linked withdrawal marker remains until expiry to prevent in-flight requests recreating the record. It does not delete your account, usage history or financial records. If withdrawal cannot reach the server, sign in to the same account and retry as prompted, or contact support.

Questions and requests

Contact MaxAPI to ask about account information or request an applicable correction or deletion. Some records may need to be retained for billing, fraud prevention, security, or legal reasons.