Privacy policy
Last updated: October 7, 2026
Who we are
egenio FX (egenio.net and api.egenio.net) is run by egenio. egenio is responsible for the data described in this policy.
What we collect and why
Like every website, our server receives your IP address and your browser's name (its "user agent") when you open a page or call the API. Most data protection laws in Latin America treat an IP address as personal data. This is what we do with it:
| What | Why | How long |
|---|---|---|
| IP address, in memory only | To stop abuse: limit how many requests, failed keys, test keys or admin sign-in attempts come from one address | At most 1 minute, or until the end of the day (UTC) for the test key limit. Never written to disk |
| An anonymous daily visitor code | To count how many different people visit the site each day. The code is made from your IP address, your browser's name and a random secret that changes every day and is never saved, so it can't be traced back to you | Deleted after 2 days. Only the daily total is kept |
| Page views and referring websites | To know which pages are useful. We keep the page address and the referring website's domain name (for example google.com), only as totals | Up to about 2 years, as totals that aren't linked to anyone |
| IP address of API requests made without a key | To apply the daily limit for requests without an API key, and to see how much this free access is used and from where (for example, to stop abuse). We store the address, the day, the number of requests and the time of the last one | 30 days, then deleted automatically |
| Your API key's details | To check your key and its monthly limit. We store a fingerprint of the key (not the key itself), its plan, when it was created and how many requests it made each month. Nothing links a key to a person | As long as the key exists |
| Server security logs | To protect the server. Logs record errors, and the IP addresses of connections that try to sign in to the server or the admin console | Older entries are deleted automatically when the logs reach their size limit |
We make nightly backups of our database to recover from failures. They contain the same data as the database: no IP addresses other than those of API requests made without a key, described above.
Cookies
We use only the cookies the site needs to work. We use no advertising, tracking or analytics cookies, and no other company sets cookies on our site. That's why we don't show a cookie banner.
| Cookie | What it does | How long |
|---|---|---|
fxlang | Remembers the language you picked in the language switcher. Only set if you use the switcher | 1 year |
fxadmin, fxadmin_c | Keep the site's operator signed in to the admin console. Visitors never receive them | 12 hours and 5 minutes |
Because we don't track you, "Do Not Track" and Global Privacy Control signals change nothing: we already behave as they ask.
Why we are allowed to use this data
We use this data only because it's needed to provide the service you ask for and to keep it secure and working (what the law calls a legitimate interest). We don't use it for advertising or profiling, and we don't make automated decisions about you.
Who we share it with
We don't sell, rent or trade your data, and we don't share it for advertising. Our servers are rented from a hosting provider (DigitalOcean), which stores the data on our behalf and may keep it in a country other than yours. We disclose data only if the law requires us to.
Your rights
Depending on where you live (for example under Brazil's LGPD, Mexico's data protection law, or the laws of Argentina, Chile, Colombia, Peru or Uruguay), you have the right to know what data we have about you, and to ask us to correct or delete it, or to stop using it.
Because we don't collect names, emails or accounts, and we keep IP addresses only for moments or turn them into codes that can't be traced back (except those of API requests made without a key, kept for 30 days), we usually hold no data that we could link to you.
You can also complain to your country's data protection authority, for example the ANPD in Brazil, the Agencia de Acceso a la Información Pública in Argentina, or the Superintendencia de Industria y Comercio in Colombia.
Children
egenio FX is a service for businesses and developers. It isn't meant for children, and we don't knowingly collect data about children.
Changes to this policy
If we change how we handle data, for example when paid plans arrive, we will update this page and the date at the top before the change takes effect.