Privacy policy
Draft skeleton — legal review pending (G0 gate). The final text ships before any public launch.
Data we collect
Only what is needed to run the service. Account details: email, username, hashed password, and session tokens (or your Google profile if you sign in with OAuth). Operational telemetry: endpoints called, timestamps, token counts, and error codes. Billing metadata: payment method references and invoices, handled by Stripe.
How we use data
To operate authentication, API keys, and billing; to provide usage dashboards and cost estimates for your workspace; to prevent fraud and abuse; and to send transactional notices about your account.
Retention and security
Prompts and completions are processed transiently to route requests and are not stored by default. Payloads are never used for model training. Requests are forwarded to upstream model providers, which process them under their own policies. API keys are encrypted at rest and shown in full only once at creation. Passwords are hashed with industry-standard algorithms. Billing, audit, and fraud records are retained only as required for legal or compliance purposes.
Your choices
You can request access to or export of your account data, and request deletion of your account and keys; billing records may be retained where law requires. You can opt out of non-essential emails via the unsubscribe link in each message.
Third parties
Stripe for payment processing and fraud prevention. Google as the OAuth identity provider when you choose single sign-on. Cloudflare for hosting, edge delivery, and security. Upstream model providers for request processing under their own privacy policies.
Questions
Reach us through the contact channels on the About page and we will respond with your request status and timeline.