This policy explains what information Marilux (marilux.dev, operated by WY Studio LLC, "we") collects when you use our website and API, how we use and store it, and your rights. By creating an account you agree to this policy, including the storage location described in section 4.
1. Information we collect
| Information | Why | Kept for |
|---|---|---|
| Email address | Sign-in, verification and password-reset codes, service notices, support | While your account exists |
| Password | Sign-in. Stored only as a salted scrypt hash; we can't see it | While your account exists |
| API key and plan details | Authentication, quotas, renewals. Keys are stored encrypted | While your account exists |
| API request logs: time, path and parameters, status, response size, source IP | Quota and traffic accounting, usage charts, troubleshooting, abuse prevention | 90 days |
| Source IPs per key per day | Detecting shared or leaked keys | 30 days |
| Daily usage totals (counts and bytes only) | Usage charts and quota statistics | While your account exists |
| Email codes | Email verification and password resets | 1 day after expiry |
| Orders and redemptions: plan, amount, status, payment reference | Activating service, accounting, refunds | While your account exists |
| Sign-in cookie | Keeping you signed in. HttpOnly; we store only its hash | 30 days or until you log out |
| Website analytics: pages, referrer, browser and OS type, screen size, language, country and city derived from IP, button clicks | Understanding how the site is used | See below |
Analytics: we run the open-source tool Umami on our own server. It uses no cookies, does not store IP addresses, doesn't track you across sites, and its data is never shared. To opt out, run localStorage.setItem('umami.disabled', 1) in your browser console.
Payments: crypto payments are processed by CCPayment. To create a checkout page we send them the order number, plan name, price and your email address (so they can send you a receipt). We keep the order number, amount, network, transaction hash and sending address so we can confirm payment, keep accounts and issue refunds. Blockchain transactions are public by nature. We never receive card or bank details.
We don't collect your real name, government ID, phone number, contacts or precise location.
2. How we use information
- To provide the service: sign-in, API authentication, quota and traffic accounting, renewals.
- To keep it secure: detecting abuse, leaked keys and faults.
- To contact you: verification and reset codes, replies to your questions, and important service changes. We don't send marketing email.
- To improve the service, using anonymous analytics.
3. Service providers
These providers process some information on our behalf, limited to what each needs:
| Provider | Purpose | Information |
|---|---|---|
| Vultr (servers in Tokyo, Japan) | Runs the website, API and database | All of the above is stored here |
| Cloudflare | Network delivery, security, support email forwarding | Requests including IP; emails sent to our support address |
| Alibaba Cloud DirectMail | Sending verification and reset emails | Your email address and the email content |
| CCPayment | Crypto payment processing | Order number, plan, price, your email address and your payment transaction |
| Market data suppliers | Supplying market data | Only query parameters (e.g. ticker, dates) — never your account, email or IP |
We don't disclose personal data to anyone else except where required by law.
4. Where data is stored
Our servers are in Tokyo, Japan. If you're outside Japan, your data is transferred there to provide the service; we protect it to the same standard wherever you are.
5. Security
- HTTPS everywhere.
- Passwords are salted scrypt hashes, API keys are encrypted, and session tokens are stored only as hashes.
- Only necessary ports are open, the database isn't exposed, and admin access is restricted.
- Daily database backups, kept for 14 days.
If a security incident affects your data, we'll tell you by email what happened, the likely impact and what we're doing about it.
6. Retention and deletion
Retention periods are listed in section 1. When you delete your account, we delete your account data, API key and redemption history within 15 business days; request logs expire on their normal schedule (at most 90 days) and backups roll off within 14 days, unless the law requires us to keep something longer.
7. Your rights
Depending on where you live (for example under the GDPR or CCPA), you can ask to access, correct, export or delete your personal data, object to or restrict processing, and withdraw consent. You can see your account, plan, usage and logs in the console at any time. To make a request, email [email protected] from your account address; we reply within 15 business days. You can also complain to your local data protection authority.
8. Children
The service is for developers and businesses and isn't directed at anyone under 16.
9. Changes
We'll post updates here with a new date, and email you in advance about significant changes that affect your rights.
10. Contact
Questions or complaints: [email protected].