Stored for an account: the username, a password hash, API key hashes (never the keys) and records of the API games played with its keys (the deals and moves, the account id and key label). Deletion on request to the site owner.