Privacy Policy

Last updated: August 2026

Sylvia API is a read-only gateway to public Reddit data. This policy tells you
what data we collect, what we do with it, and what we do not collect.

We keep this policy short on purpose. We are not a social network. We are not
an advertising company. We sell access to an API. The only data we hold is the
data we need to run that API.

1. Who we are

Sylvia API lets developers read public Reddit data through a simple REST API.
You give us an API key. We return posts, comments, and subreddit data as JSON.

Two roles matter for this policy:

• Data controller. We control the account data you give us. That means
  your email address, your API keys, and your usage records.
• Passthrough. We do not control the Reddit content the API returns. We
  fetch it on demand and pass it to you. We do not store it. Reddit's own
  terms govern that content.

2. What we collect

We collect only what we need to run the service.

Account data. When you sign up, we collect your email address. We use it
for login and account recovery. We issue an account token and, when you create
one, an API key.

Usage data. We record request counts and timestamps per key. We use this
for billing and to stop abuse. We also record a short in-memory history of
your recent requests. That history is visible only to you.

Payment data. You add credits with crypto. A payment provider handles the
payment. We store your balance. We do not store your wallet address.

Technical logs. We log standard technical data. That includes your IP
address, browser type, and request times. We use these logs for security and
rate limiting.

3. What we do not collect

We do not collect any of the following:

• We do not run KYC. We never ask for identity documents.
• We do not take credit cards or bank details.
• We do not store the Reddit content you read. The API is stateless.
• We do not sell your data. We do not share it for marketing.
• We do not use third-party advertising cookies.

4. How we use your data

We use your data for four things, and nothing else.

First, we authenticate you. Your email and API key let us know you are you.

Second, we bill you. We charge per successful request, and we need your usage
records to do that.

Third, we stop abuse. We watch for spam, scraping at abusive scale, and
attacks on our service.

Fourth, we comply with the law. We answer valid legal requests when we must.

5. Legal bases for processing

Where the GDPR or UK GDPR applies, we process your data on these bases.

Where we rely on legitimate interest, we checked that it does not override
your rights. You can object to that processing at any time.

6. Cookies and local storage

We use local browser storage to keep you signed in. We do not use tracking
cookies. We do not build advertising profiles.

7. Your rights

You have rights over your data. You can:

• Access. Ask for a copy of the data we hold about you.
• Correct. Fix data that is wrong or incomplete.
• Delete. Ask us to delete your account and its data.
• Export. Get your data in a common machine-readable format.
• Object. Object to processing that relies on legitimate interest.

Email [email protected] to use any of
these rights. We reply within 30 days.

8. How long we keep data

We keep account data while your account is active. Request history lives in
memory only and is not archived. When you ask us to delete your account, we
delete its data.

9. How we protect your data

We encrypt data in transit. We store API keys hashed, not in plain text. We
limit access to the people who need it. No system is perfect. If you think
someone else used your account, contact us right away.

10. Where your data lives

We process data mostly in the European Union and the United States. When data
moves between regions, we use standard safeguards such as Standard Contractual
Clauses.

11. Children

Our service is not for children under 16. We do not knowingly collect data
from children under 16. If you think we did, tell us and we will delete it.

12. Changes to this policy

We may update this policy. When we do, we post the new version here and update
the date at the top. Keep using the service after a change, and you accept the
new policy.

13. Contact

Questions about this policy? Write to
[email protected].