HK Data API

Legal

Privacy Policy

Last updated: 13 June 2026

HK Data API is a read-only proxy over public data published by data.gov.hk. This policy explains what we store and why.

Account data

To create an account we store your email address (used for identification and quota assignment) and an optional display name. Authentication is passkey-only — we never receive or store a password.

Credentials

  • Passkeys are stored as WebAuthn server-side credentials (public key and metadata). Your private key never leaves your device.
  • API keys are stored only as SHA-256 hashes. The full key is shown once at creation and cannot be recovered.
  • Refresh tokens are stored as SHA-256 hashes; plaintext is never persisted.

Usage & logging

We track request counts to enforce quotas. For authenticated users this is keyed by user ID; for anonymous requests, by a fingerprint of IP address and User-Agent. Logs contain user IDs only — never emails, request bodies, or response data.

Security

All traffic is HTTPS-only with HSTS enforced. The JWT signing secret is encrypted at rest. See our security overview.

Your choices

You can revoke any API key, remove passkeys, and sign out of all sessions from the portal. Contact us to request deletion of your account and associated data.