Privacy Policy

We collect three broad categories of data.

Account data

Your email address, and optionally your name and phone number if you provide them. Your password is never stored in plain text — PocketBase hashes it and we only ever hold the hash. If you enable two-factor authentication we also store an encrypted TOTP secret and hashes of your unused backup codes.

API usage data

For each request through the gateway we record the API key used, the model requested, token counts (input, output and cached), the computed cost, the response status, latency, and a timestamp. This is what makes metering and billing possible, and it is also what the usage dashboard renders.

Request and response bodies may be captured for debugging and abuse prevention. Treat prompt content as potentially visible to us, and do not send secrets or sensitive personal data you would not want logged.

Technical data

Our gateway records the source IP address and user agent on requests, and a request identifier, so that we can rate-limit abuse and trace incidents. Server logs are kept for operational and security purposes.

We do not collect payment card numbers — settlement happens outside the platform, and we never ask for card details in the dashboard or over chat.

• To run your account — authenticate you, secure the session, and let you manage keys and settings.
• To meter and bill usage — count tokens, compute cost, and deduct it from your prepaid balance.
• To show you your usage — power the dashboard, usage history, and per-model breakdowns.
• To keep the service safe — detect abuse, enforce rate limits, investigate fraud, and debug failures.
• To support you — answer your questions and diagnose problems you report.
• To meet our obligations — comply with law and enforce our Terms of Service.

We do not sell your personal data, and we do not use your prompt content to train models.

We use a single strictly necessary cookie to keep you signed in. It holds your PocketBase session token and is set httpOnly, sameSite=lax, and path-scoped to the site, so it is not readable from page scripts. It expires after 7 days, and signing out clears it.

Because this cookie is required for authentication, there is nothing to opt out of while you are signed in. We do not run advertising, cross-site tracking, or third-party analytics cookies, and there is no consent banner because there is nothing optional to consent to.

To serve a request, we forward it to the upstream model provider that hosts the model you asked for. That provider receives the prompt content and model parameters, and processes them under its own privacy terms. We do not send it your email address, password hash, or balance.

We also rely on infrastructure providers for hosting and storage. These providers process data on our behalf and are not permitted to use it for their own purposes.

We do not sell, rent, or trade personal data. We may disclose data if compelled by law, or where necessary to investigate abuse, protect our rights, or prevent harm — and we will limit what we disclose to what the request actually requires.

Passwords are stored only as hashes. Vendor API credentials and TOTP secrets are encrypted at rest with AES-256-GCM. Your API keys are generated with a cryptographically secure random source, and the gateway compares supplied keys against stored hashes rather than plaintext.

Secret material is stripped before user records leave the server, and logs pass through a redaction layer that scrubs known key patterns and authorisation headers.

That said, no system is perfectly secure. The most common real-world risk is a leaked API key, because a key is a bearer credential that can spend your balance. Keep keys out of client-side code and public repositories, rotate them if exposed, and enable two-factor authentication. We will never ask for your password or a full API key over chat or email.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy in a portable format, or object to and restrict certain processing.

Much of this you can do yourself: your profile and keys are editable in the dashboard, and your usage history is visible there. For anything else — including deletion of your account, or a copy of your data — email us and we will respond within a reasonable period, normally within 30 days.

We keep account and usage records for as long as your account is open, and afterwards only as long as needed for billing, tax, fraud and legal purposes, after which they are deleted or anonymised. Ask us to delete your account and we will also revoke your keys.

Privacy questions and data requests go to support@apistore.live. Put "Privacy" in the subject so it is routed quickly. For anything urgent, message us on Telegram.