Privacy Policy

QuotesJS is a personal side project that serves a searchable collection of quotes over a public HTTP API. It is not a company and it is not a commercial service. This page describes exactly what the running system stores, because that is the only honest version of a privacy policy.

If you create an account with an email address and password, the database stores:

• your username and email address
• a bcrypt hash of your password, never the password itself
• an optional display name
• your generated API key, account type, and daily request count
• the time of your last sign in

If you sign in with Google instead, Google returns your Google account ID, email address, display name and profile picture URL, and those are stored in place of a password. Only theprofileandemailscopes are requested. Nothing else in your Google account is accessible to this service.

Every API request is logged, whether or not you have an account:

• the endpoint, method and query parameters
• your IP address and browser user agent
• the response status, response time and result count

Request logs exist to enforce rate limits and to debug failures. Anonymous callers are rate limited by IP address, so the IP is the only way to count them.

There are no analytics, no advertising, no tracking pixels and no third party scripts. No data is sold or shared with anyone. Your authentication token is a JWT held in your browser's local storage, not a cookie, and the server keeps no session for you.

Everything runs in containers on a single rented server in France, in a SQLite database on that machine. Google is the only third party involved, and only if you choose to sign in with it, in which case their own privacy policy also applies.

Account records are kept until you ask for the account to be deleted. Request logs are kept indefinitely at present; there is no automatic expiry job, and saying otherwise would be a promise the code does not keep.

Open an issue at github.com/aminetroudi/quotesjs asking for deletion, or use the support email shown on the Google consent screen when you sign in. Your account row, API keys and request logs are removed together.

If this policy changes, the date at the top changes with it. The history of this page is public in the repository linked above.