Privacy
Last updated 29 September 2026.
Nonprofiteer is run by Crismali Industries LLC, an Illinois limited liability company. This page says what we collect about the people who visit the site or use the API, why, and how long we keep it.
It is not about the people named in the filings we publish — that is a page of its own.
Browsing the site
There are no accounts, no analytics, no advertising and no tracking. The pages you browse set no cookies. If you choose light or dark mode, that choice is stored in your own browser and never sent to us.
Your IP address is used while your request is being served — to limit how fast any one address can make requests — and that count is held in memory only; it is not written to our database.
Our server keeps an ordinary log of the pages requested, which for a search includes what was searched for. If something goes wrong while serving a request, we also record the error with the request that caused it, including your IP address and browser identification, with form fields and search terms removed. Error records are deleted 30 days after we mark the problem fixed; an error we have not yet fixed is kept until we do.
Asking for an API key
The key form asks for an email address, and optionally a name and a sentence about what you are building. We store those, with the IP address the request came from, to confirm you control the address, to send you the key and messages about it, to reach you if your use of the API starts failing, and to limit abuse of the form. Your key itself is never stored — only a one-way fingerprint of it, which cannot be turned back into the key.
- A request you never confirm is deleted 30 days after its link expires.
- A request you confirm is kept, because it is the record of how a key was issued. Its IP address is erased 30 days after the request.
- Your key-holder record — your name and address — is kept after a key expires or is revoked, so a key that was abused can still be traced. Ask us and we will delete it, with your keys and every request made from your address.
We email you only about your key: the confirmation link, and the notice that a key is active. No newsletters, and your address is never shared with anyone except the email provider that delivers those messages.
Backups
We copy the database every day and keep the copies for disaster recovery: the last 7 daily copies, 4 weekly and 12 monthly. So something deleted from the live database can remain in a backup for up to 12 months before that copy is itself deleted. Occasionally we take an extra copy by hand before risky maintenance; those are kept until we delete them. Backups are used only to restore the service.
Who else handles it
We do not sell or rent anything we collect, and we do not share it except with the services that run the site on our behalf:
- Cloudflare — every request passes through it for security and caching, it stores our backups, and it keeps its own logs under its own policy. It also hides email addresses on our pages from automated harvesting.
- Resend — delivers the key emails, and so handles your address and the messages we send you.
- Netcup — hosts the server the site runs on.
We would disclose information if the law required us to, and not otherwise.
Your choices
You can ask what we hold about you, ask us to correct it, or ask us to delete your key-holder record, by writing to [email protected]. Deleting it deletes your keys and your key requests with it, so your API access ends. We will answer from the same address.
This site is not directed at children, and we do not knowingly collect anything from them.
If this policy changes, the date at the top changes with it.