API Documentation: Privacy Compliance Endpoints

Graze has two public endpoints for privacy requests: one to ask for your data to be removed, and one that reports how many requests we've received and how quickly we answered them. Neither needs a login.

All requests use this base URL:

https://api.graze.social/app/api/v1/privacy-compliance

POST /request-removal

Files a request to remove the data held for the account that uses a given email address.

Request

Send a JSON body with Content-Type: application/json:

• email (string, required): the email address on the account you want removed.
• bluesky_did (string, optional): the Bluesky DID of the account, if you know it.
• bluesky_handle (string, optional): the Bluesky handle of the account, if you know it.

curl -X POST "https://api.graze.social/app/api/v1/privacy-compliance/request-removal" \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "bluesky_handle": "user.bsky.social"}'

Response

{
  "filed": true
}

filed is always true once the request has been recorded.

What happens next

• Graze looks for a Graze account, and for a Patreon connection, that uses the email address. Only the email is used for this match. The Bluesky DID and handle are kept with the request to help us act on it.
• If nothing uses that email address, there is no data to remove, and the request is marked as complied with straight away.
• Otherwise the request is recorded and the removal is carried out after it's filed.
• You can file more than one request for the same email address.

POST /request-stats

Returns statistics about data removal requests. These are the figures we publish in our privacy policy.

Query parameters

• year (integer, optional): only count requests made in this calendar year (UTC). Leave it out for totals across all years.
• include_deleted (boolean, optional, default false): include requests that have been deleted.

curl -X POST "https://api.graze.social/app/api/v1/privacy-compliance/request-stats?year=2025"

Example response

{
  "total_requests": 120,
  "complied_requests": 110,
  "denied_requests": 2,
  "median_response_days": 0.4,
  "mean_response_days": 1.7,
  "include_deleted": false,
  "year": 2025
}

• total_requests: how many requests were received.
• complied_requests: how many we have complied with.
• denied_requests: how many were denied.
• median_response_days: the median time to comply, in days, rounded to one decimal place.
• mean_response_days: the average time to comply, in days, rounded to one decimal place.
• include_deleted: whether deleted requests were counted.
• year: the year counted, or null for all years.

Notes

• Response times are measured from when a request was filed to when it was complied with, and only cover requests that have been complied with. A request handled in 12 hours counts as 0.5 days.
• If no requests have been complied with, both response times are 0.