Privacy Policy
Last updated: 2026.07.01
Ultra-short version
- The website itself (this thing you're reading right now): Zero tracking. No tracking cookies, no analytics, no Vercel Insights, no nothing. The only thing Vercel sees is what they need for DDoS protection and basic routing — that's on them, not us. You can read their policy here.
- Actually using the API: We don't log your IP, we don't log which endpoints you call, and we definitely don't care how long you stared at the JSON. Successful requests with valid API keys = hourly count of requests per key saved in Redis, Failed/abuse-level requests = temporary IP block enforced by Vercel Firewall and DDoS protection.
- We don't use Google Analytics, Vercel Analytics, Plausible, or any of that nonsense. We turned all of it off on purpose.
- Your email and associated name (only when you request an API key): That's the only personal info we ever store. It goes straight into a private Redis instance which is protected. We don't share it, sell it, rent it, or accidentally CC your mom or boss on the newsletter (well, there is no newsletter).
- If you wish to use the buymeacoffee service: We only receive the information you choose to share on Buy Me a Coffee (e.g. display name, message). Payment details are handled by their payment processors and are never shared with us. See Buy Me a Coffee's privacy policy: buymeacoffee.com/privacy-policy.
The boring but legally required bits
This website (https://srilanka-holidays.vercel.app/) AND the API (https://srilanka-holidays.vercel.app/api) are hosted on Vercel. Like any hosting provider, Vercel processes basic server logs (IP address, request time, etc.) for security, performance, and abuse prevention. We have disabled Vercel Analytics and all optional tracking features. For details on what Vercel logs, please see their privacy-policy here: vercel.com/legal/privacy-policy
When you request an API key, we store your email address, the name associated with that email account, along with other system-generated data (such as the API key itself), in a private Redis instance hosted within the European Union (EU). Both the email address and name are encrypted before storage using the Fernet encryption scheme, which provides authenticated encryption based on AES-128 and HMAC-SHA256. Encryption keys are securely managed and are not accessible to unauthorized parties.
We do not share, sell, or rent your personal information to third parties. Your email address and name are used solely for the purpose of managing your API key, providing you with access to the API, and maintain communication regarding the service. We do not use this information for marketing purposes or any other unrelated activities.
Abuse Prevention Measures
We take measures to prevent abuse of our API, including monitoring for suspicious activity and implementing rate limits to ensure fair usage. As part of these measures, all authenticated requests to the API increment a counter in Redis associated with the API key. This counter is used solely for monitoring usage and enforcing rate limits. We do not log the specific endpoints accessed or the content of the requests. These counters are temporarily stored and automatically reset after a 30-day period. In the event of abuse or suspicious activity, we may temporarily block the associated API key and notify the user via the registered email address.
Use of Cookies
This website does not use cookies for tracking or analytics. The only cookies that may be set are essential for basic functionality, such as session management for the dark mode toggle. These cookies do not track your browsing behavior.
Third-Party Links and Services
Our website may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party websites you visit.
Children's Privacy
Our services are not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under 16, we will take steps to delete such information promptly.
Your Rights
You can ask to view, update, or delete any personal information we have about you at any time by contacting us at halt-pledge-paper[-at-]duck.com.
Will this ever change?
We have no plans to introduce tracking or additional data collection. Should that ever change, we will clearly announce it and update this policy before any new practices take effect.
Questions? Reach out to us: halt-pledge-paper[-at-]duck.com