Data retention

Different records serve different operational and accounting purposes.

Security and abuse prevention

To prevent fraud and protect accounts, we record IP addresses, browser user-agents, language, account and API-key identifiers, and activity times. A first-party browser identifier expires after 30 days. We store a keyed hash of that identifier and basic browser signals as an approximate fingerprint, not proof of identity. We do not use canvas, audio or hardware fingerprinting. Security records are accessible only to MFA-verified administrators, removed after 30 days of inactivity, and removed on account deletion. Cloudflare Turnstile processes verification signals to protect signup and login.

Prompt and response content

Our servers process content transiently for forwarding and streaming without storing it. Optional browser-only chat history remains until you delete it or clear site data. Turning saving off for a chat removes its saved copy; disabling the default does not delete existing chats. Account deletion clears saved chats in the current browser; copies in other browsers must be cleared there. Upstream inference and network providers apply their own policies.

Usage metadata

Content-free request metadata is subject to the configured activity retention schedule. The default scheduled cleanup removes usage metadata older than 30 days. Aggregate and financial records can have separate retention needs.

Sessions and security

Authentication sessions expire and can be revoked. Token hashes, verification records, and necessary security records are retained only for their active purpose and configured lifecycle.

Financial records

Financial records remain after account deletion for accounting, payment reconciliation and applicable legal obligations.

Provider boundaries

Cloudflare, OxaPay, and the inference provider process data independently. This schedule describes the application, not an unverified zero-retention agreement with upstream services.

Updated November 1, 2026.