# Privacy

What the myanglish API does with your text. Applies to this codebase as
shipped; anyone self-hosting is responsible for their own deployment.

- **Text is not stored.** Requests are converted in memory and the response is
  sent; nothing is written to disk or a database.
- **Text is not logged.** Logs hold method, path, status and timing only
  (`crates/api/src/lib.rs`, `TraceLayer`).
- **Metrics hold no text.** `/metrics` counts requests by route pattern and
  status and records latency. No bodies, query strings or client addresses.
- **Client IP addresses** are held in memory only as rate-limit keys, forgotten
  after about a minute of inactivity, and never logged. Limits: 5 requests a
  second per address (20 at once), and 5 corrections at once, then one every
  30 seconds.
- **No third parties.** Conversion runs locally; no text is sent to another
  service.

## Corrections you choose to send

The try-it page has a "Not right? Fix it" form (API: `POST /v1/feedback`). It
is the only way text is stored, and only when you tick the consent box and
press send.

- **What is stored:** what you typed, what the engine gave, your correction,
  the engine's name and data version, and the time. Not your IP address or any
  other identifier.
- **Where:** one file on the server (`MYANGLISH_FEEDBACK`), readable only with
  the admin token. Corrections are reviewed by the maintainer and may become
  part of the project's test or training data, which is published with the
  code.
- **Don't send private details** (names, phone numbers, addresses): the text
  may be published as data.
- **Deletion:** corrections are kept until they're reviewed. To have one
  removed, open an issue or contact the maintainer with the text you sent.
- Servers that don't set `MYANGLISH_FEEDBACK` store nothing at all.