Access records
The access database stores a key ID, SHA-256 hash of the random API key, operator-supplied label, plan, creation time, expiry, revocation time, monthly quota, minute limit, current usage windows and counters, and last-use time. The raw key is displayed once during local issuance and is not recoverable from the database.
Labels should use a billing reference or application name instead of unnecessary personal details. Key records remain in the database until the operator removes them according to its actual retention policy. This implementation does not silently promise or perform an automatic deletion schedule. Billing records and correspondence are handled outside the API and may have separate retention requirements.
Calculation requests
Calculation inputs are processed in server memory to produce the requested JSON response. The application does not write those bodies, individual results or a per-request activity history to its database. It does not request wallet phrases, private keys, exchange trading credentials or payment-card information.
The provided API location disables Nginx request access logs, and Gunicorn request access logging is disabled. Operational errors can still appear in service logs. The operator must review any additional proxy, hosting, monitoring or security logging it enables; this application cannot control unrelated infrastructure.
Market requests and third parties
When a licensed market adapter is enabled, the server sends a fixed public GET request to the selected provider. That provider sees the server’s network address and normal request metadata. The BTCMox customer key is not forwarded upstream. Requests specify public instruments and intervals, not a customer exchange account.
Normalized market results may remain in memory for their short cache lifetime and disappear when the worker restarts. Cache keys describe provider, instrument and interval. The API does not fetch arbitrary customer-supplied URLs or accept wallet address queries.
Browser access and your choices
The default browser origin is https://www.btcmox.com. Additional origins require an explicit configuration entry; wildcard access and authentication cookies are not used. An allowed origin still needs its own valid API key for authenticated routes. Store paid keys on a controlled server instead of exposing them in frontend code.
Use the About page for the operator’s identity and contact details, and to ask about access records, billing records or a suspected key disclosure. Include the key ID rather than the secret key. The operator must assess retention and requests using its actual service, contractual and legal obligations; no automated rights-request portal is claimed here.