Last updated October 4, 2026
Privacy policy
This policy describes what information the looks.nyc website, API and MCP server collect and how it is used.
The website
- No cookies, no analytics, no advertising or tracking scripts.
- Fonts and everything else are served from our own domain — your browser makes no third-party requests.
- We don’t keep visitor logs for this site.
The API and MCP server
- Query text. We do not store the text of queries, and it is not written to our logs.
- Aggregate statistics. When a request mentions terms from our own style vocabulary — a material, a garment type, a color, a brand, a category, an aesthetic or a price range — we add one to a daily counter for that term (for example “corduroy +1”). Counters carry no query text, no key, no IP address and no time beyond the day. They expire after 88 days and are then deleted automatically, so none is kept longer than 90 days.
- API keys. Getting a key needs no account, email or name. For each key we store a label, its limits, the date it was created and a one-way hash of the key — never the key itself, and nothing about who asked for it. We also count how many keys are created each day (the count expires after two days).
- Rate limits. To enforce limits we count requests per key: per-minute counts expire after one hour and per-day counts after 88 days, and are then deleted automatically, within about two days of expiring; monthly counts are kept for quota and expire after 13 months.
- Where this is stored. API keys (as hashes), counters and the aggregate statistics are stored in the United States, encrypted at rest. Every counter carries an expiry time and is deleted automatically. The catalog the API searches is a read-only snapshot of public information about shops; it contains no user data.
- Operational logs contain only a random request ID, the time, the endpoint type, the status and the response time — no IP address, no key and no request details. They are deleted after 30 days.
Messages to hello@looks.nyc are forwarded to the person who runs the service. The forwarding system deletes its copy after 7 days. We use your address only to reply.
Who processes data
Hosting and email are provided by a cloud provider in the United States. To build profiles we process public information about shops (their websites and catalogs) with AI models; no user data or queries are sent to them. We don’t sell or share data with anyone, and we don’t use it for advertising.
Your choices
Email hello@looks.nyc to have an API key revoked and its associated counters deleted, or with any privacy question. The service is not directed to children under 13.
Changes
If this policy changes, we’ll update this page and its date.