Privacy

Privacy

Until is built to know very little about you. This page says what we do store, why, and who else touches it. Last updated 2026-10-15.

The short version

• No cookies and no tracking scripts. No third-party analytics, no ads, no fingerprinting.
• We count visits on our own server, using daily-salted hashes that cannot be linked from one day to the next.
• There are no accounts. Your credit key is a secret that only you hold, and we store only a hash of it.
• Card details go to Stripe. We never see or store them.
• We do not sell your data.

Who we are

Andreoni-Group, LLC runs Until at untilapi.com. Questions about this page: our support email (coming soon).

When you visit the site

We set no cookies. To see whether anyone is using the service, our server keeps simple counters per day: page views of the home, docs, crawler-info and public-notices pages, and counts of API calls, checkouts and watches. For unique-visitor counts it stores a short hash of your IP address and browser user-agent, mixed with a secret and the date. The hash is truncated, cannot be reversed without the secret, and cannot be matched from one day to the next. We do not store your raw IP address, user agent, referrer or the pages you read. Hashes are pruned after about 14 days; the daily totals stay.

To protect the free dry-run from abuse, your IP address is held in the memory of the server handling the request, for rate limiting only. It is not written to our database.

Our hosting provider, Vercel, handles every request and may keep its own logs, such as IP addresses, as described in its privacy policy.

When you use the API or MCP server

• Dry-run checks. We fetch the public URL you give us and return what we saw. We count the call, but we do not store the URL or the result.
• Credit key. Created when you start your first checkout and shown once. We store only a hash of it, plus your balance and a ledger of purchases and watch charges. There is no way to recover a lost key.
• Watches. We store the URL and condition you chose, the check interval, the webhook URL and webhook secret if you set them, the values we observed, check counts and the receipt when a watch matches (matched value, time, HTTP status and a hash of the page content). Those records are tied to your credit key, not to a name.
• Webhooks. If you give a webhook URL, we send signed POST messages there with the watch id, URL and receipt details. Make sure the endpoint is yours and can receive them.
• Pages we fetch. UntilBot reads public pages only and identifies itself in its user agent. See UntilBot crawler info.

When you pay

Payments are handled by Stripe Checkout. Stripe collects your card details and an email address for the receipt, and handles them under its own privacy policy. We never see or store your card number or your email address from checkout. We store the checkout id, the pack, the amount, the Stripe session id and the credit it added, all linked to your credit key. If Stripe tells us a payment was refunded or disputed, we remove the matching credits. Card checkout currently runs in Stripe test mode, which moves no real money.

Public-notice trial requests

If you send the trial request form on /public-notices, we store the name, email address, company, trade and pages you type, in our database (Supabase). We use them only to reply to you about the trial and the service. The form never sends an email by itself. To limit spam, we also store a daily-salted hash of your IP address, which is cleared after about 14 days, and we accept at most 3 requests per network per day. We keep a request only as long as we need it for the trial or a service you sign up for. Ask us and we will delete yours.

Who else handles data

• Stripe processes payments.
• Supabase hosts our database, in the United States.
• Vercel hosts the website and API.

We do not sell or rent personal data and we do not run advertising. We may disclose information if the law requires it.

Your choices

You can use the dry-run and read every page without giving us anything. To ask us to delete a trial request, or to ask what we hold about a credit key, contact our support email (coming soon) and include the checkout id or watch id (never the credit key itself).

Changes

If we change what we collect, we will update this page and its date. Until is not directed at children.