Data and privacy
This page describes what the code running at Spend Gateway’s base URL does with data today.
What Spend Gateway stores
Spend Gateway knows an owner only by owner_uid, the subject (sub) of the
ChirpAuth token they called with. It learns no name or email address. For
each owner it stores:
| Data | Contents |
|---|---|
| Grants | app_id, limits, period, settlement, and whether it is revoked |
| Wallet | The balance in units, and a record of each credit Stackwell made: units, when, and which Stackwell client made it |
| Open reservations | Which grant, and how many units are held |
| Usage | One record per settlement: the reservation, the grant, the units and the time |
| Settlement keys | The key each settlement was made under, so a repeat doesn’t charge twice |
Spend Gateway stores no payment details: it takes no payments.
Logs. Operational logs are kept for 14 days.
Spend Gateway runs on AWS in the us-east-1 region (United States).
How long
Spend Gateway deletes nothing. Revoked grants, usage and settlement keys are kept with no end date. Logs are the exception, at 14 days.
Who sees what
- The owner can read their grants, each grant’s balance, and their usage, through the API.
- Stackwell services that do metered work for an app reserve and settle against the owner’s grant for that app. They name the owner and the app; the reservation and settlement responses carry units and a reservation id, not the grant’s other fields.
- The app itself does not call Spend Gateway and sees nothing from it, unless the service doing the work passes something on.
Deleting data
Not yet:
- There is no way to delete Spend Gateway data. No endpoint deletes a grant, a wallet or usage; revoking a grant marks it and keeps it.
- Deleting a ChirpAuth account, or a Granite account, does not reach Spend Core.