Privacy Policy

Updated October 15, 2026. This policy covers the Color API website at color.koval.dev and the Color API at color.koval.tools, both run by koval.dev. The KD Color Chrome extension has its own privacy policy.

Your account

Accounts are handled by Clerk, our sign-in provider. When you sign up, Clerk stores your email address, any name you give, and the details it needs to keep you signed in, such as your active sessions and the device and IP address they came from. We use your email to send you API keys and to reply when you write to us.

API requests

• The colors you send are used to compute the response. Responses may be kept in Cloudflare's cache, looked up by the color values in the request, so repeat requests are faster. Color repair requests are never cached.
• Request logs record the time, the kind of request, the response status and any error code, how long it took and whether it came from the cache. They do not include your IP address, your API key or the colors you sent.
• Rate limiting counts requests per minute. Requests without a key are counted by IP address, and a count is deleted soon after its minute is over.
• API keys are stored only as a SHA-256 hash, together with your account ID, your plan, and when the key was created or revoked. We can't read your key back.
• Monthly usage is a request count per account per month, kept for 62 days.

This website

The site is hosted by Netlify, which processes standard request data, such as IP address and browser, to serve and protect it. Sign-in needs a few cookies, and if you accept in the cookie banner, Google Analytics counts visits and the pages you view; see the cookie policy. The color tools keep your recent colors in your browser's local storage, which never leaves your device.

What we don't do

No advertising and no tracking across sites. Analytics run only if you agree to them. We don't sell or rent your data, and we don't share it except with the providers below, to run the service.

Providers

• Clerk: accounts and sign-in.
• Cloudflare: runs the API, its cache and its rate limits, and protects it from abuse.
• Netlify: hosts this website.
• Google Analytics: website visit statistics, only if you accept analytics cookies.

Your choices

Email us to get a copy of your account data, to correct it, or to delete your account and revoke your API keys. We keep emails you send us so we can reply and follow up.

Changes

If this policy changes, we'll update it here and change the date at the top. For changes that matter, such as a new provider or new data we collect, we'll also email account holders.

Contact

Questions about this policy or your data: m@koval.dev.