Privacy policy

The tools, the lessons and the test API's core endpoints (echo, HTTP methods, status codes, and the products, posts and todos resources) need no account. A free account unlocks the rest of the test API and the API builder. You create it with a username and password, or by signing in with Google or GitHub; what it stores is described below. We do not sell personal information. The developer tools run in your browser, so what you paste into them is not sent to us. Messages you send to Jason, the chat assistant, are sent to an AI provider to answer them. If you support the site through Buy Me a Coffee, the details you enter go to Buy Me a Coffee, not to us. The site may show ads from Google, which uses cookies as described below.

The tools under /tools, such as the JSON formatter, JWT decoder and hash generator, process your input with JavaScript on your device. The text, tokens and files you give them are not uploaded to our servers.

When you call api.testingapis.com, from your own code or from the "Try it" panels in the docs, the server receives the request you send: its URL, headers, body and your IP address. Data you create through the API is kept in memory and is lost when the server restarts. It is shared test data, so other people may see it while it exists.

Endpoints outside the free tier need an API key from your account. The API checks each key with our account service, as described under Accounts and API keys, and removes it from the request before any endpoint handles it, so it is never echoed back or stored with test data.

Do not send real personal data, real passwords or production secrets to the API. Use the fake data it provides.

An account is free. It is needed for the test API's endpoints outside the free tier and for the API builder. You can create one with a username and password, or by signing in with Google or GitHub. What we store depends on how:

• Username and password. We store your username, your email address and a salted, one-way hash of your password. We never store the password itself and cannot see it. We send a link to the address to confirm it is yours; you need a confirmed address to join a team workspace. We also use it to identify your account and to reply when you contact us.
• Google or GitHub. We ask only for your basic profile and email address. We receive and store your verified email address, the ID of your account with that provider, your display name, the address of your profile image and, for GitHub, your username. We do not receive your Google or GitHub password, and we cannot see your repositories, contacts or any other data. Signing in this way is also covered by Google's or GitHub's privacy policy.

For every account we also store when it was created and when you last signed in, and keep a record of sign-ins and of API keys being created, viewed and revoked, so we can investigate misuse of your account.

Signing in sets a session cookie on console-api.testingapis.com. It is HttpOnly (page scripts cannot read it), is used only to keep you signed in, and expires 14 days after your last visit. Signing in with Google or GitHub also sets a short-lived cookie that protects the sign-in from forgery; it is deleted when sign-in finishes. None of these cookies are used for advertising.

For each API key we store a one-way hash of the key, used to check it, and an encrypted copy, so you can view the key again on your account page; each time you do, we record it. We also store the name you gave the key, its first 8 characters so you can tell keys apart, when it was created, and when it was last used (updated at most once a minute). When you call the test API with a key, the API asks our account service whether the key is valid. The account service sees only the key, not the request, and we keep no record of which endpoints your account calls. Prefer sending the key in a header: a key in the ?ta_key= query parameter is part of the URL, so it can end up in server logs, browser history and proxies.

Your IP address is used briefly, in memory, to limit how many sign-in attempts and sign-ups can come from one address.

Account data is stored and processed on Microsoft Azure in the Central India region. We keep it until you delete your account. You can do that yourself on your account page: it immediately deletes your sign-in details, the record of your sign-ins, your API keys and everything in the API builder described below. The test API may accept a deleted key for up to 5 minutes, until its check expires. Database backups kept by our hosting provider can still contain deleted data until they expire, after at most 7 days.

The API builder lets you create your own hosted mock APIs. It uses the account described above. We store what you create: projects, the schemas you design, the records your mock APIs hold, and counts of how many requests your APIs receive, so we can apply plan limits.

To help you debug, we keep a log of recent requests to your mock APIs: the method, path, query, selected headers, the first 16 KB of each request and response body, the status, the timing and your client's IP address with its last part removed. Passwords, tokens, API keys, cookies and fields you mark as sensitive are masked before anything is stored. Logs are kept only as long as your plan allows (for example, the last 50 requests for up to 7 days on the Free plan) and then deleted automatically. You can turn logging or body capture off for a project, or clear its logs, at any time.

If you buy a paid plan, payments are processed by Razorpay, which receives your payment details and billing information under its own privacy policy. We never see or store your card details; we keep only the subscription's identifiers, its status and its renewal date, so we can apply your plan.

Builder data is stored with your account on Microsoft Azure and deleted with it. Deleting your account also cancels any subscription. Projects on the Free plan that receive no requests for 60 days are archived (they stop answering until you reactivate them), but nothing in them is deleted.

Records of payments (the amount, date, plan and Razorpay's payment and subscription IDs) are kept for as long as Indian tax and accounting law requires, even after you delete your account.

Mock APIs are for testing. Do not store real personal data or production secrets in them: anyone who knows a mock API's URL can call it unless you protect it with a key.

Every account has a personal workspace that only you can see. You can also create or join team workspaces, which several people share. In a team workspace:

• Members see each other. Every member sees the others' names, email addresses, profile images, roles and when they joined, and the projects in the workspace.
• Invitations. To invite someone, an owner or admin enters their email address. We store the address, the role offered, who sent the invitation and a one-way hash of the link's secret, and email them the link. Invitations expire after 7 days. Only invite people who expect to hear from you.
• Activity log. We record who created, changed or deleted projects, endpoints, keys and members, and when, so owners and admins can see what happened in the workspace. Entries are kept for one year, then deleted.
• The workspace's content. Projects belong to the workspace, not to the person who made them. If you leave or are removed, you lose access to them, and they stay with the workspace. The owner can delete the workspace and everything in it.

To delete your account, first delete the team workspaces you own or hand them to another member; your personal workspace is deleted with your account.

We send only the emails the service needs: the link that confirms your address, workspace invitations and, when needed, notices about your account or plan. We do not send marketing email. Emails go through an email delivery provider that sends them on our behalf; the text of each email is deleted from our systems once it has been sent.

Jason answers questions about the API in the chat window at the bottom right of each page. When you send a message, your conversation and the address of the page you are on go through our server to OpenRouter, which passes them to the provider that runs the AI model (currently NVIDIA, running its Nemotron models) to generate the answer. Those companies process the messages under their own privacy policies. We use the free versions of these models, whose providers may keep messages and use them to improve their services.

We do not store your conversations on our servers. Your IP address is used briefly to limit how many messages one person can send per minute. The conversation is kept in your browser's session storage so it survives moving between pages, and it is deleted when you close the tab or click New chat.

Do not send personal data, real passwords, API keys or production secrets to Jason. Answers are generated by AI and can be wrong; check them before you rely on them.

Like most websites, our hosting providers, including Cloudflare and Microsoft Azure, may record standard request logs: IP address, time, requested URL, browser user agent and response status. These logs are used to keep the service running, to find bugs and to block abuse. They are not used to identify you personally.

The site itself saves these things in your browser:

• Your light or dark theme choice.
• Test credentials you enter in the docs "Try it" panels, so you do not have to type them again. They stay on your device.
• Your current conversation with Jason, in session storage, until you close the tab.
• Whether this browser has signed in before, in local storage, so pages know to check who is signed in. It is removed when you sign out.
• While you are signed in, a token the "Try it" panels send to the test API. It is valid for one hour, is kept in session storage and is removed when you close the tab or sign out.

You can clear them at any time by clearing site data in your browser.

The site does not show ads yet, and no advertising cookies are set. We may later use Google AdSense to show ads on public pages, such as the docs, lessons, guides and tools, but never on signed-in pages. Before that happens we will update this section to explain the cookies Google uses and how to opt out, and visitors in the European Economic Area, the United Kingdom and Switzerland will be asked for consent before personalized ads are shown.

Each page loads a small script from Buy Me a Coffee that shows the coffee button in the bottom-left corner. Loading it sends Buy Me a Coffee your IP address and browser details, as loading any file from another site does. The support form itself only loads when you click the button.

The support form is run by Buy Me a Coffee, and the name, message and payment details you enter go to Buy Me a Coffee and its payment processors, such as Stripe and PayPal. They handle them under Buy Me a Coffee's privacy policy. We never see your card, UPI or bank details. Buy Me a Coffee shows us the amount, the name and message you entered and, depending on how you pay, your email address. Your name and message may also appear on our Buy Me a Coffee page.

We use these details only to keep a record of payments, to thank you and to reply if you contact us. We keep payment records for as long as tax law requires.

If you email us, we use your address and message only to reply and to fix the problem you reported. We do not add you to a mailing list.

The contact form sends your name, email address, topic and message to our server, which emails them to our support mailbox through our email provider. We use them only to reply, as with any email you send us.

Our server keeps the message until it has been sent, and never more than 7 days. It keeps a record of the email, whose subject includes your name and the topic, for 30 days. To stop floods of messages, the form limits how many can come from one IP address in an hour; that count is held in memory, not stored.

Account data is stored on Microsoft Azure in India. Some of the services we rely on process data in other countries, mainly the United States:

• Cloudflare, which serves the website from data centres around the world.
• OpenRouter and NVIDIA, which answer messages sent to Jason.
• Google and GitHub, when you sign in with them.
• Our email delivery provider, which sends the emails described above.
• Buy Me a Coffee and its payment processors, when you support the site.

Each of them handles the data under its own privacy policy. We send them only what they need to do the job described in this policy.

The site is meant for developers and is not directed at children. You must be at least 18 to create an account. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, email us and we will delete it.

Depending on where you live, you may have the right to ask what personal information we hold about you, or to have it corrected or deleted. If you have an account, we hold the account details and builder content described above, and you can delete them yourself on your account page. Otherwise we usually hold nothing beyond short-lived server logs, any email you send us and the details Buy Me a Coffee shares with us when you support the site. Email support@testingapis.com with any request or complaint about how we handle your data, including under India's Digital Personal Data Protection Act. We reply within 2 business days and act on a request within 30 days.

If we change this policy, we will update it on this page and change the date at the top.