Privacy policy

A clear account of what our platform stores and what its service providers process.

Trial eligibility checks

Free-trial checks use keyed browser, network-range and browser-profile counters. Browser checks use a 30-day window; network and profile checks use 24 hours. Expired counters are removed daily, and deleting an account does not reset these limits. Repeated claims may require email verification. That email does not change your sign-in credentials. We retain an opaque verified-email claim with financial history to prevent reuse after deletion. Verification links expire after one hour.

Signup sources

We use a first-party cookie for up to 30 days to remember the first tagged campaign or external referring website before signup. We retain the source, medium and campaign with the account for administrator signup reports, and remove them on account deletion. Only the referring hostname is used; referrer paths and query strings are not stored. These tags describe a visit and do not prove identity.

Security and abuse prevention

To prevent fraud and protect accounts, we record IP addresses, browser user-agents, language, account and API-key identifiers, and activity times. A first-party browser identifier expires after 30 days. We store a keyed hash of that identifier and basic browser signals as an approximate fingerprint, not proof of identity. We do not use canvas, audio or hardware fingerprinting. Security records are accessible only to MFA-verified administrators, removed after 30 days of inactivity, and removed on account deletion. Cloudflare Turnstile processes verification signals to protect signup and login.

Telegram support

When you send a support request through the Telegram bot, your message and Telegram user ID are delivered to the operator’s private Telegram inbox so we can reply. Ordinary bot commands and account information are not forwarded. Support text is processed in memory and is not saved in our database. Telegram processes these conversations under its own privacy policy.

Invites and Telegram

Referral links use a signed first-party cookie for 30 days to attribute new accounts to the first valid inviter. We retain immutable invitation and reward records with financial history. Optional Telegram linking stores a keyed hash of your Telegram identifier and shows your balance, usage and referral information in a private bot chat. We do not store Telegram message content, names or phone numbers. Telegram processes bot messages under its own privacy policy. Disconnect in Settings.

Application content

Our servers do not store your prompts, model responses, or tool-call payloads. Content passes through memory to provide inference. Chat history stays in tab memory by default. If you enable saving for a chat or new chats globally, visible messages and model settings are saved only in this browser for your account until you delete them or clear site data. They are not uploaded or synced. Anyone with access to this browser profile may be able to read saved chats.

Account and usage information

Key accounts require no email or password; their generated sign-in key is shown once and cannot be recovered. Email signup requires no name. Email accounts store the email address and any display name you choose in Settings. Optional Google/GitHub sign-in stores the verified email and provider account identifier; provider profile names, pictures and access tokens are not retained. We store protected authentication credentials, cryptographic API-key hashes, session records, and content-free usage metadata such as model identifiers, token counts, timing, status, and charges. Financial records document deposits and ledger movements.

Service providers

Cloudflare processes traffic and hosts Workers, D1, and Durable Objects. If you choose Google or GitHub sign-in, that provider processes the login under its own terms and privacy policy. OxaPay processes crypto payment details. The configured inference provider receives your prompts and generates responses; it may independently retain content and metadata under its own policy. This platform does not claim provider-side zero retention or anonymity. Resend processes your email address and account action links to deliver verification and password-reset emails. Cloudflare forwards incoming mail to the operator.

Your choices

You can revoke keys, revoke sessions, and request account deletion from Settings. Retained financial records may be required for accounting, dispute resolution, or applicable law. Do not send content you are not permitted to share with the inference provider.

Updated November 1, 2026.