Privacy notice

Last updated 27 September 2026.

In short

We do not see your requests or API data. The Restwren extension sends your requests directly from your computer to the servers you choose. Collections, environments and history stay on your computer; secrets stay in your operating system's keychain.
The extension collects no telemetry.
The only time the extension contacts us is to renew a Pro licence key, and it then sends only the key.
When you buy Pro, Stripe holds your email address, card details and customer record. We keep no separate customer database.

1. Who is responsible for your data

The controller is Nikah AI Ltd (NIKAH AI LTD, company number 17199968, registered in England and Wales, registered office Office 1216, 60 Tottenham Court Road, London W1T 2EW), trading as Restwren. We are registered with the Information Commissioner's Office under registration number ZC176381. For anything about your data, email privacy@restwren.com or write to us at the registered office.

2. The editor extension and CLI

Requests and responses travel between your computer and the APIs you call. They never pass through us.
Local files. Environments are stored in .vscode/restwren.env.json in your project. History (the last 500 requests, including responses up to 32 KB each) is stored in your editor's local storage folder for the workspace and is never synced; you can clear it in one click. Secret values and OAuth2 tokens are stored with your editor's SecretStorage, which uses your operating system's keychain.
Licence checks happen on your computer using a public key built into the extension. Nothing is sent to check a key.
Licence renewal. When a Pro key is within 5 days of expiring, the extension sends the key, and nothing else, to /refresh on this website. The key contains the product names, your plan, your Stripe subscription reference and the expiry date. It contains no name or email address. Our server asks Stripe whether that subscription is active and returns a new key or says it has ended.
The extension does not use analytics or crash-reporting services. When you ask it to, it opens your browser at this website (to buy or manage Pro) or at your OAuth2 provider (to sign in to your own API).

3. Buying Pro

Payments are handled by Stripe on Stripe's own checkout page. Stripe collects your email address, name, payment card details and billing country and postcode. Where Stripe's Managed Payments service handles the sale, Stripe's reseller (Link, known in the UK as Onelink) processes it as merchant of record and sends your receipt. Stripe and Link are responsible for that data under their own privacy notices, available at stripe.com/privacy and link.com/privacy. Card details are never sent to us.

Through our Stripe account we can see your email address, customer and subscription references, subscription status, billing country, invoices and receipts, and the time you confirmed our terms and asked for immediate supply. We use these to issue and renew licence keys, to let you recover a lost key, to deal with cancellations, refunds and disputes, and to keep accounting records.

4. This website

This site sets no cookies, uses no analytics and loads nothing from other websites. See the cookie statement.
Like any website, our server receives your IP address to send you the page. The licence service keeps short operational logs recording the time, the page or endpoint (without any query string), the response status and, for Stripe notifications, the event type and Stripe event reference. These logs contain no IP addresses, email addresses or licence keys, and are deleted automatically after 7 days.
To stop people guessing at the key recovery and renewal pages, we count requests per network address. We do not store the IP address: we keep a salted one-way hash of it in memory for at most one hour. The salt is random, never written down and replaced every day.
If you email us, we keep the conversation for as long as we need to help you and then for up to 2 years, unless it relates to a payment dispute or legal claim, in which case we keep it for as long as that matter lasts.

5. Why we can use your data (lawful bases)

Contract (UK GDPR Article 6(1)(b)): issuing, renewing and recovering licence keys, managing your subscription and answering support requests.
Legal obligation (Article 6(1)(c)): keeping accounting and tax records.
Legitimate interests (Article 6(1)(f)): keeping the service secure, preventing abuse of key recovery and renewal, and dealing with disputes. We have balanced these interests against your rights; you can object at any time.

6. How long we keep data

Billing and transaction records in Stripe: 6 years from the end of the financial year they relate to, as required for accounting records.
Licence keys: we do not keep them. Each key is created on request and shown to you.
Operational logs: 7 days. Rate-limit hashes: up to 1 hour, in memory only.
Support emails: see section 4.

Stripe (Stripe Payments UK Ltd and Stripe, Inc.) and, for Managed Payments, Link: payment processing, subscriptions, receipts and the customer portal. Stripe acts as our processor for some activities and as an independent controller for others, such as fraud prevention and meeting its own legal obligations.
Our hosting provider (OVHcloud, servers in the United Kingdom) hosts this website and the licence service.
Our email providers, if you email us. Mail sent to our @restwren.com addresses is received by Cloudflare (Cloudflare Email Routing), which forwards it to the mailbox we read and reply from.

We do not sell personal data and we do not use it for advertising.

8. International transfers

Stripe may process data in the United States. Those transfers are covered by the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), in which Stripe, Inc. participates, and by the International Data Transfer Agreement or Addendum approved under UK law. If you email us, your message may also be processed outside the UK by our email providers, under the safeguards that UK law requires for such transfers. You can ask us for more detail.

9. Your rights

You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Email privacy@restwren.com. We will reply within one month. Some records must be kept for accounting even if you ask us to delete them; we will tell you if that applies.

You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would appreciate the chance to deal with your concern first.

10. Children

Restwren is a developer tool and Pro is not sold to children under 18.

11. Changes

We will update this notice if what we do changes, and change the date at the top.