Privacy

Account data

You sign in with GitHub. We request only the read:user and user:email scopes, and we store your GitHub user id, name, avatar URL, and email address. We never request access to your repositories or your code.

Provider credentials

Provider API keys you add are encrypted before they are stored and are decrypted only in memory, at the moment a request of yours is forwarded to that provider. They are never returned to the browser and never shown again after you save them.

Request data

We record metadata only: which account and gateway key made the request, the provider and model it was routed to, token counts, request counts, and errors. We do not store the content of your prompts or the responses you receive, unless you or we turn on debug capture as described below.

Debug capture

For troubleshooting, the storing of prompts and responses can be switched on for an account. It is off unless it is switched on, and it is switched on for a fixed window - one hour, a day, or a week - after which it stops on its own. While it is on, the Logs page says so and shows the content that has been captured; you can erase all of it from that page at any time, and it is deleted with the log rows it belongs to when your plan's retention window closes. Captured content is never sent to a log destination you configure.

You can turn it on for your own account from the Logs page. We can also turn it on for an account while investigating a problem with it; every time it is switched on or off, by you or by us, the change is written to an audit trail.

Dashboard chat

The chat page in the dashboard is the one exception to the above. So a conversation can be picked back up, its messages are stored on your account until you delete them. You can delete a single conversation, or all of them, from that page. These messages are never sent to a log destination you configure, and they are separate from the request metadata described above. The requests themselves are routed through your own provider keys and count against your plan quota like any other.

Service providers

Turso hosts account and usage records. Vercel hosts the site and the API, and Vercel Analytics processes technical website usage data. The LLM providers you configure receive the requests you route to them, under their own terms.

Your choices

You can delete your provider credentials, revoke your gateway keys, and delete your stored chat conversations from the dashboard at any time. To have your account removed, use the contact options published in the project repository and do not post your email address in a public issue.