Privacy & logging
Not a policy summary. The actual columns.
Per request
One row in the usage table for every request that reaches the reservation step.
| Column | Why |
|---|---|
| id | The usage id returned to you, for reconciliation. |
| user_id, api_key_id | Which account and key made the request. Playground requests have no key id. |
| model | Which model was called. |
| status | ok, error or insufficient_credit. |
| prompt_tokens, completion_tokens | Counts from the model server, for billing and your usage charts. |
| cost_micro | Settled cost in millionths of a credit. |
| latency_ms | Wall-clock time of the request, for the performance stats on model pages. |
| created_at | Timestamp. |
Never stored
- Prompt text, message history, system prompts.
- Model output, including
reasoning/ thinking text. - Request or response bodies at the gateway or the model server. Gateway logging and caching are off.
- IP addresses or user agents in usage rows.
- The
userfield or any other request parameter. - Anything sent to analytics or advertising networks. There are none on the API.
Per account
| Data | Notes |
|---|---|
| Email, name, avatar | From your sign-in provider (Google, GitHub) or what you typed at sign-up. |
| Password hash | Email sign-ups only. Hashed by Better Auth; never stored in plaintext. |
| Sessions | Cookie sessions for the dashboard, with expiry. |
| API keys | SHA-256 hash, 10-character display prefix, name, timestamps. See Authentication. |
| Credit ledger | Top-ups, adjustments and one net usage entry per request. Stripe holds card and PromptPay details; we store the Stripe session id and amount. |
| OAuth accounts | Provider and account id only. Google/GitHub access, refresh and id tokens are discarded before the row is written; we never call provider APIs after sign-in. |
How the proxy enforces it
The gateway is a Cloudflare Worker. A chat request is parsed once to read model, messages length, max_tokens and stream, then forwarded. Streaming responses are piped through a transform that only looks for the final usage object; the bytes are never accumulated. The model server is vLLM on hardware we run, reached through a Cloudflare AI Gateway route with logging and caching disabled. No third-party model provider is ever called.
Deletion
Deleting your account removes the user row and, through foreign keys, every session, key, usage row and ledger entry. Revoking a key keeps its usage rows so your history stays consistent, but the key itself is dead immediately.