Privacy

What we collect

• An account code, a hash of the access code, and a signed session cookie.
• Account and key metadata: key names, prefixes, hashes, timestamps, and last use.
• Payment metadata: package, amount, transaction signature, deposit address, and status.
• Request metadata: model, token counts when reported, status, latency, and request identifiers.
• Basic security logs such as IP address and user agent for rate limits and abuse review.

What we do not collect

There is no KYC form, no email requirement, no card, and no password database. We do not ask for seed phrases or private keys. The proxy does not intentionally store prompt or completion content; it stores usage metadata.

How we use data

Data is used to authenticate the wallet, provision and meter the account, verify payments, provide support, prevent abuse, and meet legal obligations. Aggregated, non-identifying counters may be used to operate the service.

Processors and third parties

Model requests are sent to service infrastructure and then to the model provider. Payments use the Solana network and its RPC provider. If the operator enables NEAR Intents, quote and status data is sent to the 1Click service. Each processor has its own privacy terms.

Retention

Account, payment, and usage metadata are retained while the account is active and for a reasonable period afterward for accounting, fraud prevention, and legal compliance. Webhook deliveries are kept for a limited period. Session cookies expire after seven days.

Your choices

You can revoke API keys, rotate the access code, and sign out at any time. Because the account is keyed by an internal account ID, deletion requests need to be handled by the operator. Balance and transaction records may need to be retained for accounting.

Security

API keys are stored as hashes. Routing keys are encrypted at rest. Payment signatures are verified before balance is added. Webhooks are verified with HMAC. No system is perfectly secure; use a dedicated account and revoke keys that leak.

Contact

Use the operator contact published with this deployment for privacy requests. Never send a seed phrase or private key.