Privacy & data retention

Request and response content is never persisted. A chat completion is proxied to the upstream model provider and streamed straight back to the client; the body is never written to a database, a log file, or a queue. The only thing recorded per call is metering data: which model, and the prompt/completion token counts the upstream reported — enough to bill accurately, not to reconstruct what was said. Our schema has no table capable of holding a message body (see lib/schema.sql — users, transactions, referrals, refresh_tokens, magic_links, rate_limits; none has a content/body column).

When an upstream call fails, we log the HTTP status and model — never the response body. The same applies to the ops alert email a failure can trigger: it carries status, model, and which upstream endpoint was called, not what was asked or answered. This is enforced in code, not just policy — see app/v1/chat/completions/route.ts.

Completions are proxied to a configured upstream inference provider — DeepInfra by default, operator-configurable via an environment variable. We do not control that provider’s own retention practices; those are governed by its policy, not ours. We do not send it anything beyond the completion request itself (no account email, no billing data).

An account (email, referral code), a hashed session (magic-link and refresh-token secrets are stored as hashes, never plaintext), and billing records (balance, monthly spend, and per-call token counts — not content). See lib/schema.sql for the exact schema.