API Toolbox — Privacy Policy

1. Information we collect

Account information. When you sign in with Google or GitHub, we receive your email address and a unique user ID via Firebase Authentication. We use this to identify your account and sync your data across devices.

Your saved content. Collections, saved requests, and environments you create are stored in Google Firebase (Firestore) under your account so they sync across your devices.

Purchase status.If you subscribe to Pro, our payments provider (RevenueCat, working with Google Play Billing) tells us whether your account has an active Pro entitlement. We store a single “pro” flag on your account. We never receive or store your payment card details — those are handled entirely by Google Play.

Data stored only on your device (not collected by us).

• Request history— the last requests you ran are stored locally on your device and are not uploaded.
• Secrets vault— tokens, passwords, and API keys you store as secrets are kept in your device’s secure keychain (via flutter_secure_storage) and are never transmitted to us or written to our servers.

API request content. When you send an API request, it goes directly from your device to the third-party server you specify. We do not proxy, read, log, or store the requests you send or the responses you receive.

2. How we use information

• To authenticate you and provide the app’s features.
• To sync your collections, requests, and environments across your devices.
• To determine whether you have access to Pro features.
• To respond to support requests you send us.

We do not use your information for advertising, and we do not sell it.

3. Third-party services

The app relies on these providers, each with its own privacy policy:

• Google Firebase (Authentication, Firestore) — firebase.google.com/support/privacy
• Google Play Billing — policies.google.com/privacy
• RevenueCat(subscription management) — revenuecat.com/privacy
• GitHub(if you sign in with GitHub) — docs.github.com/site-policy

4. Data retention and deletion

Your synced data is retained while your account exists. You can delete individual collections, requests, and environments in the app at any time.

To delete your account and all associated data, email support@toolbox.services from your account email address and we will remove your data from our systems. Data stored only on your device (history, secrets) is removed when you uninstall the app or clear its data.

5. Security

We rely on Google Firebase’s security infrastructure and Firestore security rules that restrict each user’s data to that user alone. Secrets are stored in your device’s OS-level secure storage. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your information.

6. Children’s privacy

The app is intended for developers and is not directed to children under 13. We do not knowingly collect data from children.

7. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.

8. Contact

Questions about this policy or your data can be sent to support@toolbox.services.