Privacy Policy

Last updated 12 September 2026

Fake API is a tool for building mock REST endpoints. This page says what it stores, what it hands to anyone else, and what you can switch off.

What your account stores

An account holds your email address, your display name and a hashed password. Signing in with Google gives us the same two fields from your Google profile and nothing further. Alongside that sit the projects, endpoint groups and endpoints you create, which are the product itself.

Trial endpoints built on the home page without an account are not tied to you. They belong to a shared sandbox remembered in your browser, and they are deleted after 24 hours.

Cookies that are always set

Signing in sets cookies that carry your session. Without them there is no way to stay signed in between page loads, so they are not optional and are not covered by the consent choice below. They are removed when you sign out.

Analytics, and how to turn it off

We use Google Analytics 4 to see which pages people read and which of them lead anywhere. It is loaded only after you accept, and until then nothing is requested from Google at all. Accepting sets the _ga and _ga_* cookies, which give this browser an identifier so repeat visits are not counted as new people.

Google receives the pages you view, a rough location no finer than a city, and basic device and browser information. It does not receive your email address, your endpoints or anything you type into them. There is no advertising on this site, no advertising tags, and nothing is sold to anyone.

Use Cookie preferences at the foot of any page to change your mind. Withdrawing consent deletes those cookies and reloads the page without the script, and it does not sign you out. You can also block the script with the Google Analytics opt-out add-on or with your browser's cookie settings.

Who else sees your data

The site runs on Vercel and stores data in a Postgres database, both of which necessarily process it to serve the app. Verification and password reset emails are delivered through Resend. An AI generated response is designed by a model provider from the prompt and field names you supply. Beyond those and Google Analytics, no third party receives anything.

Your mock endpoints are public

An endpoint answers over HTTPS to anyone holding its URL, which is what makes it useful. Treat anything you put in a response body as published, and keep real personal data out of it.

Deleting your data

Deleting a project deletes its endpoint groups and endpoints with it. To have an account and everything under it removed, write to ngocdang.dev@gmail.com.

Changes

This policy can change. The date at the top is the one that counts, and a change that affects what is collected will ask for your consent again.