Privacy Policy

Effective 25 Sep 2026 · Data controller: operator of howtofix.id

What HowToFix stores when you use the dashboard or the API, and why. There is no analytics vendor and no ad network on these hosts.

What we collect

• Account. Username, password hash, your Gmail address, role, balance, and the tokens you create.
• Google sign-up step. When you press Continue with Google, Google tells us your verified email address and name. We keep the email address on your account and do not store the name.
• Human check. Your IP address, a one-shot human-check token and the verdict, used to tell people from bots. The challenge itself (drag forensics, proof-of-work, browser signals) is processed on captcha.howtofix.id, our own service — no third-party vendor sees it. IP-based counters are kept in memory for up to 24 hours.
• One account per Gmail. A normalised form of each Gmail that opened an account is kept permanently, even after account deletion, so the same Gmail cannot sign up again.
• API usage. Request time, model, token counts, cost, success or error, and client IP. Prompt and response bodies may be logged depending on the gateway configuration; treat them as stored.
• Transport. Traffic reaches the servers through Cloudflare, which sees each HTTPS request at its edge.

What we do not do

• No marketing pixels, ad networks, or analytics vendors.
• No third-party captcha service: the human check widget and its verifier are hosted by us on captcha.howtofix.id.
• No sale of personal data.
• No card numbers on these hosts. If you pay through a payment provider, that provider handles your payment details.

Why

To run the service: authenticate you, meter balance, bill requests, debug failures, stop abuse and account farming, and keep the service available.

Retention

Account records last until you or the operator delete them. Usage logs follow the gateway retention setting. The Gmail used for sign-up is kept as described above. Cookie lifetimes are listed in the Cookie Policy.

Your controls

You can revoke tokens and change your password in the console, and ask the operator to delete your account. Necessary cookies cannot be switched off without breaking sign-in and sign-up.

Processors