Privacy

We store your email address, a hash and short prefix for each API key, account and key timestamps, browser keys’ allowed websites, and usage counts. These support email verification, key management and limits. Each full key is shown once and is not stored.

For abuse investigation and support we keep, for 30 days, the network addresses each key is used from, the country Cloudflare reports for them, the kind of client software (browser, curl, a language library), and the website a call came from when the client sends one, and for 7 days the last 100 lookup texts sent with each key. Only the operator can see these records, and they are never sold. The operator can export account network addresses for support and abuse checks. First-week caller addresses used to link accounts are kept for 90 days.

Address, postcode, nearest and boundary lookups send no query text to any third party. Address matching runs against the service's copy of G-NAF. Usage counts do not contain the address text you look up.

The parse endpoint is the one exception. It reads messy text with a rule-based parser first. When that parser is not confident, the text you sent to parse, and nothing else, is passed to a language model hosted by OVHcloud on its AI Endpoints service to extract the address components. No API key, email address, account detail or IP address goes with it, and the model's answer is checked against the text before it is used. The service keeps up to the first 200 characters of the request under the 7-day policy above, but does not keep the model's answer beyond the response. Send only text you are comfortable having processed that way, and keep personal details out of it. There is a daily limit on these calls, and when it is reached the rule-based result is returned instead.

When you connect an app through MCP sign-in, we store the app's name and return address, which key it uses, and token hashes. You can revoke the connection from your account page.

Service logs record the route, response status, timing and client IP address for operations. Stripe processes payments and keeps billing records. Postmark delivers transactional email. Sent account email copies are redacted after 30 days; unsent copies remain until delivery or account deletion. There is no newsletter.

The site loads fonts from Google Fonts. Where enabled, the sign-up form uses Cloudflare Turnstile to verify the submission. These services receive the browser requests needed to provide those features. They do not receive lookup query text.

The public pages load Google Analytics to measure visits. It sets cookies in your browser and sends Google the page address, the referring page, and browser and device details. It is not loaded on account or admin pages, and it does not receive lookup query text, API keys or your email address.

Address data itself, the G-NAF release and the boundary files, is stored and served from the service's own infrastructure.

Cloudflare provides the network edge. Sign-up, sign-in and account-page network addresses are looked up automatically with the regional internet registries via RDAP, Cloudflare Radar and ipinfo to identify the network owner, such as a hosting provider or ISP. These lookups also support abuse investigations; they are not limited to suspected misuse. Cloudflare and ipinfo also supply available location information.

Uploaded CSV files and job results are stored with our storage provider, Cloudflare R2, until the job retention sweep removes them. Completed and failed jobs expire seven days after finishing. The sweep runs daily, so files can remain until the next sweep; unfinished jobs remain until they finish or fail.

Your theme preference is stored in your browser. Signing in uses a secure session cookie. At sign-up we set a first-party device cookie to help detect duplicate accounts sharing a free allowance. We record the network address used at registration and each sign-in. Signed-in visits to your account pages record the network address, country, city and region, when available. Full network addresses from registration, sign-ins and account-page visits, sign-in records, city and region are kept for 90 days. Country, the network block, the site you came from, the first page you opened and any campaign tags stay with your account. The site you came from, first page and campaign tags are read from your browser's session storage, not a cookie.

When you delete your account we revoke every key, cancel any subscription and replace your email with an anonymous address. We remove your device identifier, the network addresses, city and region recorded for your account, your sign-in records, how you found us, and the contents of emails we sent you. We keep your country and network block to prevent abuse, usage totals, the billing records Stripe must keep, and the audit log. Other records expire on the schedule above.