---
title: "Security and data handling · SocialToAI"
canonical: https://socialtoai.com/security/
updated: 2026-11-06
---

# Security and data handling

SocialToAI needs no account of yours, stores API keys only as hashes, keeps the answer to a call for 24 hours so that you can read it again, and keeps commenters anonymous.

- Page: https://socialtoai.com/security/
- Last updated: 2026-11-06

## Your platform accounts

- No account of yours is needed: no sign-in to a platform, no cookie, nothing to install. Nothing is read in your account's name.

## API keys

- We store only a key's SHA-256 hash and its last four characters. The whole key is shown once, when it is created, and cannot be shown again.
- A key is not written to logs, to page addresses or to browser storage. A request that carries a key in its address is refused, and is told to revoke that key.
- Each key can have its own permissions, expiry date and daily limit; you can revoke it at any time in the console.

## Signing in from an AI app

- ChatGPT, Claude and other clients that can sign in use OAuth with PKCE, and never see a key. You press Allow on our page, and can revoke the connection in the console.
- Tokens are stored only as hashes. An access token lasts one hour; a refresh token changes every time it is used.

## Results and request details

- The answer to a call is stored encrypted (AES-256-GCM) for 24 hours, so that you can read it again for free, and then deleted. Only the key that made the call can read it over the API; the account's owner can read it in the console.
- A ready-made tool's run also keeps a summary for 30 days: numbers and links only.
- The parameters of a call are kept for 90 days and then cleared.

## Commenters

- Commenters are always anonymous: a label for that one request, with no name, id or avatar, even for verified accounts.

## Logs

- Run logs do not keep the full responses we read. Access logs keep the path before the question mark, and credentials in headers are masked.

## Payment

- Checkout is hosted by Stripe, so a card number never reaches us. Credits are added only when Stripe's signed notice arrives.

## Deleting your account

- You can delete your account yourself in the console's settings; its keys stop working at once. The [privacy policy](https://socialtoai.com/privacy.md) says what is kept and for how long.

## Report a security problem

- Write to [support@socialtoai.com](mailto:support@socialtoai.com).

- [Data freshness, compliance and account safety](https://socialtoai.com/docs/data-and-usage.md): How fresh the data is, and what is yours to check.
- [Authentication](https://socialtoai.com/docs/authentication.md): Keys, headers and permissions.