Privacy policy until 12 October 2026
Last updated
What we collect
When you sign in with Google or GitHub, we receive the account identifier and basic profile information that provider shares, such as your email address. We also process API request and WebSocket connection metadata, quota usage, security events, and normal website logs. If you subscribe, we retain identifiers that link your Narwhal account to its Stripe customer and subscription, plan and payment status, paid-period dates, cancellation state, and billing event records.
How we use it
We use this information to create and secure your account, issue and verify API keys, measure quota, operate the service, reconcile payments and subscriptions, enforce access and connection limits, prevent abuse, and respond to support requests. Narwhal stores a one-way verification value for your API key, not the complete key.
Service providers
We use infrastructure and identity providers to run Narwhal. Google or GitHub handles the sign-in step you choose. Supabase handles account authentication. Hosting and monitoring providers process the technical data needed to deliver and protect the service. Stripe processes payments and provides hosted Checkout and the billing portal. When you pay, your payment details are collected by Stripe; Narwhal does not receive or store your complete card number or card security code. We share an account identifier with Stripe to associate payments with your account, and receive billing status and related records. Stripe may also process information for fraud prevention, security and its own legal obligations under its Privacy Policy.
Your choices
You can stop using the service at any time. To request access to, correction of, or deletion of account information, email hello@narwhalapi.com. Some records may be kept when needed for billing, security, legal obligations, or resolving abuse and disputes. Canceling a subscription stops renewal according to your billing terms; it does not automatically erase required billing records. We do not promise a deletion deadline for records that must be retained.