Privacy

Last updated 2026-09-20.

This covers two groups of people: you, if you have an account, and the visitors to your sites, whose browsers request images from us. The operator is named in the terms. Everything runs in the United States (AWS us-east-1), behind Cloudflare.

What we store about you

• Your email address and name, from the sign-in method you choose (Google, GitHub, or email). We do not see your Google or GitHub password.
• Your keys, their labels, and the domains you allow them on.
• Daily request counts per key — hits, letter marks and rejections — for your usage page.
• A log of actions taken in your account, such as a refresh you requested, so we can answer "what happened" if you ask.
• Your Stripe customer id and subscription status. Card details are held by Stripe; we never see your card.

What we store about your visitors

Nothing that identifies them. A logo request tells us a domain was asked for, which key asked, what we served and how long it took. We do not set cookies on the image endpoint, we do not store visitor IP addresses, and there is no tracking pixel — the response is an image and nothing else. A request without a key is rate limited by IP address, held in memory for one minute and never written down. Cloudflare, which fronts every request, keeps its own edge logs under its own policy.

Our own website

The pages on favi.sh — this one, the docs, the dashboard — are different from the image endpoint. On these pages:

• Signing in sets one session cookie. That is the only cookie we set, and it is essential to being signed in.
• We use Mixpanel for product analytics: page views and actions such as creating a key, tied to your user id once you sign in. It stores its identifier in your browser's local storage and reports through our own domain. There is no session replay, and we do not record what you type.
• We use Sentry to collect error reports when a page breaks. Reports carry the error, the page and the browser type, and are scrubbed of keys and secrets. They do not include your IP address.

Email

We send a sign-in link, an email verification, a password reset, and two usage notices, at 80% and 100% of your monthly quota. That is the full list. There is no newsletter and no marketing mail, and nothing in the application to send one. Mail goes out through Amazon SES; an address that bounces or marks us as spam is suppressed for good.

Who else is involved

These companies process data on our behalf, each for the one purpose stated:

• Amazon Web Services — hosting, image and backup storage, email delivery.
• Cloudflare — content delivery and DNS in front of the API and the site.
• Stripe — payments and invoices.
• Mixpanel — product analytics on the website, as above.
• Sentry — error reports from the website and our servers.
• Better Stack — our server logs, which name domains and keys but not visitors, held for three days; and the uptime checks on our endpoints. The availability probe the SLA is measured against runs on Cloudflare's network, not on our server.

We do not sell data, share it with advertisers, or use it to train anything.

Retention

• Account data, keys and usage counts are kept while your account exists.
• Server logs are held for three days in Better Stack and archived in our own storage for 30 days, where they name domains and keys but not people.
• Close your account — from Settings in the dashboard — and we delete your account, keys, usage and analytics profile immediately. Three things outlast that, and this is all of them: our encrypted database backups, which age out within 30 days and are only ever restored to recover the whole service, never to bring one account back; if an address of yours ever bounced our mail or reported it as spam, a one-way keyed hash of that address stays on our do-not-mail list so we never send to it again, and our email provider (Amazon SES) keeps its own bounce and complaint record of the address; and Stripe records we must keep for tax and accounting, for as long as the law requires.
• One security record of the closure is kept for twelve months: the account id, what was removed, and a one-way keyed hash of your email address so we can answer you if you later ask whether the account was really closed. Your address itself is not in it, and the hash cannot be turned back into it.

Your rights

You can see, correct, export or delete what we hold about you. Email [email protected] from your account address and we do it; there is no form to fill in. If you are in the EU, UK or California, those laws give you these rights by name; we honour them for everyone.

Changes

We update this page when what we do changes. A change that matters — a new processor, a new kind of data — is emailed to account owners before it takes effect.