Privacy

1What we never keep

• No request or response content is stored or logged on any route. The router relays bodies and writes nothing.
• No third-party scripts, trackers or analytics on any host.

2What we keep about requests

Each request leaves one metadata row and nothing else.

• What is kept, per table: usage metadata (time, model id, key id, token counts, cost, request id, upstream name, latency and status) indefinitely; resource ids for async tasks; payment addresses and transaction ids (txids); the credit ledger, indefinitely.
• Upstream response field names may be logged for task diagnostics; their values are not.

3Your login

• The web login database, separately: email, display name, password hash, two-factor secret and recovery codes, and each session's IP address and user agent, kept until that session is revoked or the account is deleted.
• Conversations in the dashboard chat live only in your browser; nothing about them is written to any server.

4What the operator sees

• Key names reach operator logs and metrics; account names reach operator logs. Metrics identify accounts by id only.
• The upstream gateway sees the request body and the model id, never your account, key or address.

5Deletion

• Deleting your account revokes every key, cancels pending top-ups, tombstones your email and revokes every session. The usage and credit ledgers are retained.
• A payment sent to an old deposit address after account deletion is credited to the closed account and forfeited.