VoxGuardAPI

Privacy policy

Last updated: October 13, 2026

This privacy policy explains what information VoxGuard API collects, how it is used, and what choices you have. VoxGuard API is a self-hosted software application; the operator of this installation is the data controller.

1. Information we collect

  • Account data - your name, email address and a bcrypt password hash created when you register.
  • API key metadata - key names, scopes, creation and expiration dates, and a SHA-256 hash of each secret. The full API key is shown once and is not stored.
  • Request metadata - for each API call: request ID, timestamp, endpoint, HTTP status, duration, language, input length, error category and the detection verdict.
  • Security data - login attempt records used for throttling, and an administrator audit log of administrative actions.

2. Information we do NOT store

  • The text of messages submitted to the detection endpoint. Logs record only the input length and the detection result.
  • Full API key secrets - only one-way hashes.
  • Plaintext passwords - only bcrypt hashes.

3. How information is used

  • To authenticate you and protect your account.
  • To provide the detection API, request logs, usage statistics and rate limiting.
  • To detect abuse, throttle brute-force attempts and keep an administrator audit trail.
  • To send transactional email (such as password reset links) when SMTP is configured.

4. Third parties

VoxGuard API does not send your messages to third-party AI services. Detection runs locally using the integrated open-source profanity_php word lists. No analytics or tracking scripts are included.

5. Retention

Request logs and rate-limit counters are retained so usage history stays accurate. Stale rate-limit windows are purged automatically. Administrators can clear logs and counters from the admin panel.

6. Your rights

You can view and delete your API keys at any time, and request account deletion from the administrator. Login attempt records expire automatically after a short window.

7. Security

Access is protected by hashed credentials, CSRF tokens, prepared statements, session hardening, login throttling and per-key rate limits. Use HTTPS - see the README for TLS configuration instructions.

8. Contact

Questions about this policy should be directed to the operator of this installation.