Security

API access uses keys prefixed with sfk_. Send keys in the x-api-key HTTP header. Treat keys like passwords: store them securely, rotate them if exposed, and do not commit them to source control. Keys are stored hashed on our side; we only show the full secret once when you create a key. You can create, name, disable, and delete keys in the dashboard.

You can sign in with OAuth providers (Google, GitHub, or Discord) and enable two-factor authentication (2FA) on your account. Sign-in sessions record IP address and user agent for abuse prevention. You are responsible for activity under your account and for protecting your credentials.

Every public API response includes a requestId (in meta.requestId on success or error.requestId on failure). The same value is returned in the X-Request-Id HTTP header. You may send X-Request-Id on inbound requests. Quote requestId when contacting support so we can match your report to server-side logs.

The dashboard and our support team can look up API request history by requestId while the log row is within its retention period.

Each API call creates a database row containing minimal operational fields such as the endpoint, HTTP method and path, status code, credits charged, and any error code. Under standard retention, the row also contains request parameters and limited response previews; those payload fields are not durably stored for zero-retention accounts. Rows are not a permanent archive of platform content. We retain standard operational API logs for approximately 30 days, including request metadata and limited response previews, for support, billing, abuse prevention, and reliability, then delete them. Accounts can opt into zero retention: live processing still occurs, but we do not durably store request parameters, target URLs, or response previews; minimal operational, billing, security, and reliability metadata remains. Hosted screenshots and similar short-lived media artifacts are retained for approximately 7 days. Where a customer explicitly opts into hosted social-media originals, those objects are retained for approximately 90 days. Objects are then deleted automatically; customers needing longer retention should download and store the bytes themselves. Logs support billing, abuse detection, support lookup, and reliability work. They are not a permanent copy of third-party platform content.

For personal data in customer-instructed API requests and results, Social Freak Ltd acts as the customer’s processor; the customer remains controller and is responsible for its instructions and lawful basis. We do not sell that data or use it to train machine-learning models, and disclose it only as needed to provide, secure, and support the Services, including through authorised subprocessors.

We store account and billing metadata needed to operate the Services: profile details, authentication identifiers, credit balance and ledger entries, invoice metadata from Stripe, and the API request logs described above. We do not permanently archive third-party platform content on your behalf; API responses are returned to you at request time. Hosted screenshots and similar short-lived media artifacts are retained for approximately 7 days. Where a customer explicitly opts into hosted social-media originals, those objects are retained for approximately 90 days. Objects are then deleted automatically; customers needing longer retention should download and store the bytes themselves.

We publish at /subprocessors a concise, non-exhaustive register of material service providers we publicly identify. Additional diligence information may be available on reasonable request where legally permitted and subject to applicable confidentiality and contractual restrictions. See the Service Provider Register.

We maintain an internal process to triage, contain, investigate, and document suspected security incidents. We notify affected customers without undue delay and, where feasible, within 72 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data, providing available information in phases where necessary. See the DPA for the customer-assistance framework.

We process personal data in line with UK GDPR, the Data Protection Act 2018, and EU GDPR where it applies. Social Freak Ltd acts as processor for customer-instructed API workload personal data and as independent controller for account, billing, fraud/security, and direct-relationship data. This is not a third-party certification programme. For legal bases, retention, international transfers, and your rights, see the Privacy Policy. Questions: support@socialfetch.dev.