Terms of Service

API Usage Terms

The following terms apply specifically to use of the KoalaPic REST API ("API") and API keys. By generating an API key or making API requests, you agree to these additional terms alongside the general Terms of Service above.

API Keys & Authentication

API keys are issued to individual user accounts and are non-transferable. You are responsible for maintaining the confidentiality of your API keys and webhook secrets. You must not share your API key publicly, embed it in client-side code, or include it in version control repositories. If you believe your key has been compromised, you should revoke it immediately via your dashboard and generate a new one. We reserve the right to revoke any API key at any time without notice if we detect misuse.

You may hold a maximum of 10 active API keys per account. Each key may be individually named, revoked, or configured with webhooks. Revoked keys cannot be reactivated — you must generate a new key.

Rate Limits & Fair Use

API requests are subject to rate limits to ensure fair access for all users. The current default limits are 30 requests per minute and 500 requests per day for authenticated requests. These limits may change at any time. Current limits are returned in response headers (X-RateLimit-Limit-Minute, X-RateLimit-Limit-Day) on every API response.

When you exceed a rate limit, the API returns HTTP 429 (Too Many Requests) with a Retry-After header indicating when you may retry. Repeated rate limit violations trigger progressive cooldowns (increasing wait times) and may result in temporary IP-level blocking for up to 24 hours. Persistent or deliberate abuse may result in permanent account suspension.

You must implement appropriate backoff logic in your integration. Ignoring Retry-After headers and continuing to send requests during cooldown periods is considered abuse.

Data Processing & Retention

Files uploaded via the API are processed on our servers and stored temporarily for download. Converted files are automatically deleted approximately 1 hour after conversion. We do not retain copies of your files beyond this period. Conversion metadata (file formats, sizes, timestamps, status) is retained for 1 year for authenticated users and 30 days for anonymous requests. API usage logs are retained for 90 days.

You retain all ownership rights to your uploaded content. We do not use your files for training, analytics, or any purpose other than performing the requested conversion. We do not inspect, analyze, or share the content of your files.

You are solely responsible for ensuring you have the right to process any files you upload. You must not upload files containing illegal content, malware, or content that violates third-party intellectual property rights.

Webhooks

Webhook notifications are provided on a best-effort basis. We do not guarantee delivery of any specific webhook event. Webhook deliveries are attempted up to 3 times with exponential backoff (immediately, then after 30 seconds, then after 2 minutes). After 3 failed attempts, the delivery is marked as permanently failed and no further attempts are made.

Webhook delivery records are retained for 7 days. Your webhook endpoint must respond with an HTTP 2xx status code within 10 seconds to be considered successful. We are not liable for any consequences of missed, delayed, or duplicate webhook deliveries.

Webhook payloads are signed using HMAC-SHA256. You should verify the signature on every incoming webhook using the webhook secret provided at key creation. We are not responsible for security issues arising from failure to verify webhook signatures.

Service Availability & Limitations

The API is provided "as is" without any uptime guarantees or service level agreement (SLA). We aim for high availability but may experience downtime for maintenance, upgrades, or unforeseen issues. We are not liable for any losses resulting from API unavailability.

We reserve the right to modify, deprecate, or discontinue any API endpoint, parameter, or feature at any time. While we will make reasonable efforts to communicate breaking changes in advance, we do not guarantee advance notice for any API changes.

The API is intended for image format conversion only. You must not use the API for any purpose other than converting images between supported formats. Specifically prohibited uses include: using the API as a file storage or hosting service, reverse-engineering the API, circumventing rate limits through multiple accounts or keys, or reselling API access without authorization.

API Liability & Indemnification

The API converts images using automated processing. We do not guarantee that conversions will preserve all metadata, color accuracy, or visual fidelity in all cases. You are responsible for verifying that converted files meet your requirements before using them in production.

Our total liability for any claims related to the API is limited to the amount you have paid us in the 12 months preceding the claim, or $0 if you are using the free tier. We are not liable for indirect, incidental, special, consequential, or punitive damages arising from your use of the API.

You agree to indemnify and hold harmless KoalaPic from any claims, damages, or expenses arising from your use of the API, including but not limited to claims related to the content you process through the API.