Privacy Policy

1. What we commit to

• No model training. We do not train, fine-tune, or evaluate models on your prompts, completions, or uploaded content.
• Content logging is off by default. Prompt and completion text passes through memory and is discarded when the response ends, unless you turn logging on for a specific API key yourself.
• No third-party tracking. No advertising pixels, no analytics scripts, no cross-site trackers. Web fonts are served from our own origin rather than fetched from a font provider, so loading a page contacts nobody else.
• No card or bank details. Balances are funded by stablecoin transfer, so there is no card number or bank identifier for us to hold.

2. What we collect

A. Account identity

Signing in with GitHub gives us your numeric GitHub account id, username, display name, avatar URL, and primary email address. We ask for read-level profile data only and never receive access to your repositories.

B. Request records

For every request the router serves, we record:

• The time, and an identifier you can quote back to us.
• The canonical model you addressed, for example claude-opus-5.
• The HTTP status, time to first token, and total duration.
• Input and output token counts, and the exact amount debited.

These are the billing record. They are what your dashboard reads, what an invoice is derived from, and what lets us answer a question about a charge months later.

C. Content logging, only when you enable it

Each API key carries a content logging switch that is off when the key is created. While it is on, the prompt and the response for requests made with that key are stored in a separate table from the billing record, with a hard deletion deadline set when the row is written. Turning the switch off stops new content being stored immediately; rows already written are removed on their existing deadline.

The model's reasoning, where a model produces it, is stored in its own field rather than mixed into the response. It is kept for the same period and deleted by the same sweep.

D. What your plan changes

Your plan decides whether content logging is available at all, which is the one place a plan changes what we keep rather than what you can reach:

• Free and Pro: the switch above is available. It is still off until you turn it on, per key.
• Premium: we do not store the text of your requests, and the switch cannot be turned on. The dashboard shows it disabled with that reason, and the gateway refuses to store content for these accounts whatever a key says.

This describes what we keep. A model provider that serves your request may keep its own operational records under its own policy, which is true on every plan and is not something we can switch off on your behalf.

Content rows are stored in the database without an additional layer of encryption beyond the encryption of the underlying storage and the access controls on the database itself. If that matters for your data, leave content logging off.

E. Deposit records

Topping up stores the deposit address assigned to you, the transaction hashes that arrived, the amounts, and the confirmation counts. These are needed to credit your balance and to reconcile it later.

3. Cookies and local storage

This site sets two cookies and neither is used to track you:

• A session cookie once you sign in, which is what keeps you signed in. It is removed when you sign out.
• inf_locale, which remembers the language you chose so the site does not revert to English on the next page. It holds a language code and nothing else.

Both are strictly necessary for the site to do what you asked it to do, which is why there is no consent banner asking you to accept them. We set no advertising or analytics cookie, so there is nothing here to opt out of. If we ever add one, it will be off until you turn it on.

4. How data reaches model providers

We are a router. To answer a request we send your prompt over TLS to a model provider that runs the model you addressed, and stream the result back to you. Which provider serves a given request is an internal routing decision and can change between requests.

We select provider accounts whose terms prohibit using data sent through the API to train their models. We cannot make a promise on a provider's behalf beyond that, and a provider may keep its own operational records of a request under its own policy.

5. How long we keep it

• Request records and ledger entries: kept for the life of the account. They are the accounting trail and an account cannot be audited without them.
• Logged content, including reasoning: deleted after the retention window, which is 30 days on this deployment. A background worker deletes rows whose deadline has passed and runs on a schedule measured in hours, so a row may outlive its deadline by up to an hour before the deletion runs.
• Deposit records: kept for the life of the account, for the same reason as the ledger.

6. Security

Traffic is served over TLS. API keys are stored as SHA-256 hashes and never in a form we can reverse, which is why a lost key can only be replaced and not recovered; the key itself is a 256-bit random value, so it cannot be guessed from its hash. Supplier credentials are encrypted at rest with a key held only in the environment. The admin panel requires a second factor on top of a sign-in, and administrative actions are recorded in an audit log.

7. Your rights

Depending on where you live you may have rights over your personal data, including access, correction, and erasure. Two of those are self-service today and the rest are handled by asking us:

• Correction: profile details and preferences are editable from your dashboard.
• Content deletion: switching content logging off for a key stops further storage, and revoking a key stops it being used at all.
• Access, portability, and erasure: not yet self-service. There is no export button and no delete-my-account button in the dashboard today. Ask us and we will do it by hand. Erasure has one limit worth stating plainly: ledger entries recording real money movements are kept, so an erasure detaches your identity from them rather than deleting the accounting trail.

8. Contact

Questions about this policy, or a request under any of the rights above, can be raised from your dashboard or sent to us directly.