Legal
Effective date: October 2, 2026 · Last updated: October 13, 2026
This Privacy Policy describes how Joshuah Charney, a sole proprietor doing business as Signup Risk API ("Signup Risk," "we," "us," or "our"), collects, uses, and shares information in connection with https://www.signuprisk.com, https://app.signuprisk.com, https://api.signuprisk.com, https://docs.signuprisk.com, and related services (the "Service").
Signup Risk API is operated by Joshuah Charney, a sole proprietor. Mailing address for notices: 15201 Mason Rd, Ste 1000 #513, Cypress, TX 77433, USA. Email: privacy@signuprisk.com.
Signup Risk API is a developer-facing signup-risk analysis service operated by Joshuah Charney as a sole proprietor. We are not a general identity-verification, KYC, mailbox-verification, or payment-fraud platform.
When you create or manage an account, we may collect:
You can sign in with an email one-time code, a password, or a Google or GitHub account. We and our sign-in provider (Clerk) collect your first and last name and email address. If you sign in with Google or GitHub, we also receive basic profile information from that provider, such as your name, email address, and profile image.
We also store a keyed hash of your account email so we can find your account when you contact support. It is deleted when your account is erased.
Paid plans are processed by our payment processor. We do not store full payment-card numbers on our servers. Our payment processor receives card and billing details necessary to charge your subscription. We may receive limited billing metadata (plan, invoices, payment status, last four digits or similar tokenized references).
When you call the Service, you may submit:
This data typically relates to your end users or leads. You are responsible for having a lawful basis to submit it.
We generate and may store:
We automatically collect technical data such as:
We aim to minimize raw personal data in logs. Where feasible, logs prefer request identifiers and truncated or hashed values rather than full emails or raw signup IPs. Operational logs are kept for about 30 days. Backups and point-in-time restore copies of our database are kept for a limited period set by our database provider, expire on a rolling basis, and are not available as a customer self-service archive.
Our marketing site (www.signuprisk.com) is hosted by Webflow and loads fonts and scripts from Google (Google Fonts and Google Hosted Libraries), so your browser sends your IP address and browser information to Google when you visit. Our network and security provider, Cloudflare, sets a strictly necessary cookie (_cfuvid) used for security and rate limiting. Our dashboard (app.signuprisk.com) uses Cloudflare Web Analytics, a cookieless analytics tool that records page views, referring pages, browser and device information, and technical data such as IP address, to help us understand and improve the dashboard. Our sign-in provider, Clerk, uses cookies required to keep you signed in. We do not use advertising cookies or cross-site advertising trackers. If that changes, we will update this Policy first.
Our documentation site (docs.signuprisk.com) is hosted by Mintlify, which may collect usage analytics through its own tools. Requests you send from the interactive API playground in our documentation, including any API key and test data you enter, are routed through the servers of Mintlify, so please use a test key there.
We use information to:
We do not sell personal information for money. We do not use API request content to build unrelated advertising profiles.
We share information with:
Service providers we use today:
We will update this list when we add or replace a provider that processes personal information.
Public domain lookups. To evaluate an email domain, we query public DNS resolvers and domain-registration (RDAP) services using only the domain (for example, example.com), never the full email address.
Your webhook endpoints. If you configure webhooks, we send analysis results, which can include the analyzed email address, to the URLs you choose. Those endpoints are under your control.
We do not sell API request data to data brokers.
Typical retention:
Retention may be extended if needed for disputes, security investigations, or legal holds. Our service providers keep copies of data they process for us under their own retention schedules and legal obligations (for example, our payment processor keeps transaction records as required by law).
When you close your account, or send a verified deletion request to privacy@signuprisk.com, we will delete or de-identify, within 30 days of the closure or request: your account profile, including the keyed hash of your account email; API keys and webhook configurations; and analysis history, bulk job files and results, and webhook delivery records. Usage records are deleted 90 days after closure, as described in Section 5. Closing your account through the dashboard or our sign-in provider starts this process. We wait a short grace period (about 7 days) before erasing a closed account in case the closure was a mistake, and any active paid subscription is canceled first; erasure still completes within the 30 days.
We may keep: billing and tax records as required by law; limited information needed for security, fraud prevention, or legal compliance (for example, a record that an account was closed for abuse); and backup copies until they are overwritten on their normal schedule. Copies held by our service providers (for example, Stripe's payment records and Clerk's sign-in records) are deleted under those providers' own processes and schedules. We will confirm by email when primary deletion is complete.
After your account is erased, we keep a minimal record with only internal identifiers, your sign-in provider user ID, the account status, and deletion dates, so a deleted account cannot be recreated by mistake. It contains no name, email, or usage content.
If a customer checked your email address. The steps above cover our account holders. When one of our customers submits your email address or other details to the Service, we process that data on the customer's behalf as its service provider, and the customer decides how it is used. We do not build a profile of you, and we do not offer a tool to look up or erase a single email address across customers. Instead, that data is removed automatically on the schedule in Section 5: analysis cache within 24 hours, bulk files within 7 days, and bulk job records and webhook delivery records within 30 days. To make a request about that data, please contact the customer that submitted it. If you contact us, we will direct you to that customer.
Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of certain personal information, or to object to or restrict certain processing. U.S. state privacy laws (including, where applicable, California) may provide additional rights.
To exercise a request, email privacy@signuprisk.com. We may need to verify your identity and account control. If you are an end user of one of our customers, please contact that customer, which controls your signup data; we act as its service provider (see Section 6).
You may opt out of non-essential marketing emails using the unsubscribe link (service/transactional messages will continue).
We use administrative, technical, and organizational measures designed to protect information, including encrypted transport (TLS) for Service connections, scoped API keys, and access controls. No method of transmission or storage is 100% secure. Public statements about specific controls (for example, what is stored in cache keys) are intended to reflect current product behavior and may be updated as the Service evolves.
Our main infrastructure is in the United States: Google Cloud (us-central1) runs the API, and our Turso database is hosted in AWS us-east-1. Some providers process data in other countries: Cloudflare handles requests at network locations near the person making them, and our privacy inbox is hosted by Proton in Switzerland, so messages you send to privacy@signuprisk.com are stored there. Our other service providers may process data in the United States or other countries where they operate. We currently focus on customers in the United States. If you use the Service from outside the U.S., your information will be processed in the U.S., which may have different data-protection rules than your country.
The Service is directed to businesses and developers. It is not intended for individuals under 16, and we do not knowingly collect personal information from children.
If you submit personal information about others (including signup emails, names, or IPs), you represent that you have the right and any required notices/consents to do so, and that your use complies with applicable law. You should configure your own application's policies for how you use Signup Risk recommendations.
We may update this Policy from time to time. We will post the updated version with a revised "Last updated" date. Material changes may also be communicated by email or in-product notice. Continued use after the effective date constitutes acceptance of the updated Policy where permitted by law.
Signup Risk API is operated by Joshuah Charney, a sole proprietor. Mailing address for notices: 15201 Mason Rd, Ste 1000 #513, Cypress, TX 77433, USA. Email: privacy@signuprisk.com.
