Privacy Policy

What we store

Account: your email address, a bcrypt hash of your password, your balance, and the account creation time. We cannot read your password.

Orders: order id, amount, currency, product, status, the email address used at checkout, the payment provider's order reference, and, for paid documents, a redeem code and a download counter.

API keys: a hash of the key plus its first few characters, so we can display it in a list. The key itself is never stored and cannot be recovered.

Usage log: for each API call, the model, input and output token counts, the cost charged, whether it was streamed, and the timestamp.

What we never store

Card numbers, Alipay credentials and WeChat credentials. Payment data is entered on the payment provider's own hosted page and never reaches our servers.

The content of your prompts and the models' responses. We record token counts, not text.

Any advertising identifier, cross-site tracking profile or data broker enrichment. We do not sell or share personal data, and we run no advertising.

Where API request content goes

To answer a request we relay it to Vercel AI Gateway, which forwards it to the upstream provider of the model you selected. The response comes back the same way. This is the only purpose for which request content is transmitted.

We do not persist that content, but the upstream providers process it under their own privacy terms, which we cannot vary on your behalf.

Practical consequence: do not send personal data, secrets or confidential material through the API unless you are permitted to disclose it to a third-party processor.

Cookies

tok_session: an httpOnly signed session cookie set when you sign in, valid for 7 days. Without it you cannot stay logged in.

A signed download-access cookie, valid for 30 days, set after you buy a paid document so you can re-download it without re-entering your redeem code.

That is all. There are no advertising or cross-site tracking cookies, and therefore no consent banner to click through.

Analytics

We load Vercel Insights, which reports aggregate page-performance and traffic metrics to us. It measures page loads, not people: it builds no cross-site advertising profile and we cannot use it to identify an individual visitor.

Processors we rely on

Vercel - hosting, edge network and server logs.

Neon - the managed PostgreSQL database holding the account, order and usage data listed above.

Creem - merchant of record for international card, Apple Pay and Google Pay payments. It receives your email address and the order amount, and independently handles payment data and tax.

XunHuPay - technical service provider for Alipay and WeChat Pay from mainland China. Funds are settled by Alipay or WeChat Pay directly to the operator.

Vercel AI Gateway and the upstream model providers behind the models in our catalog, for the request relay described above.

How long we keep it

Account data until you ask us to delete it. Deleting your account also deletes your API keys and usage log, which cascade from the account record.

Order records are kept for as long as accounting and tax rules require, even after account deletion, because we are legally obliged to be able to evidence a sale. They are then no longer linked to a live account.

Your rights

Email mingxinai@agentmail.to or 13426086861@139.com to get a copy of your data, correct it, or have your account and its data deleted. We act within one business day and do not charge for it.

Depending on where you live you may also have the right to object to processing, to restrict it, or to complain to a data-protection authority. Ask us and we will help rather than obstruct.

Security

Passwords are hashed with bcrypt. API keys are stored only as hashes. Sessions use signed httpOnly cookies. Payment callbacks are signature-verified and processed idempotently, and the domestic payment callback is additionally re-verified against the provider before any credit is applied.

No system is perfectly secure. If you find a vulnerability, email us and we will fix it and credit you if you want the credit.

Children and international transfers

The service is not intended for anyone under 18, and we do not knowingly collect data from children.

Our infrastructure and payment providers operate internationally, so your data is processed outside your country of residence.

Changes

If we change this policy the revision date above changes with it. We will not quietly start collecting something this page does not list.