Privacy policy

What we collect

• Your API key, as a fingerprint. We store a SHA-256 hash of each key, never the key itself. That’s why a lost key can’t be recovered, only replaced.
• No name or email to get a key. API keys are issued without an email address or card. To limit abuse we count key requests per IP address per day, and we store that IP only as a one-way hash.
• Account and usage records. Credit balance, purchases, and per-request usage: model, token counts, cost and time. These power your account page, your usage log and billing.
• Payment confirmations. When you buy credit, Stripe tells us the payment succeeded and which key to credit. We never receive your card number.
• Server logs. Like most websites, our hosting keeps standard access logs (IP address, time, page requested, browser type) for security and troubleshooting.

Your prompts and model outputs

To answer a request we forward your prompt to OpenRouter and on to the provider of the model you chose. Their handling of that content is governed by their own policies. Our usage log records metadata such as model, tokens and cost. It doesn’t show prompt or response text.

Who else processes data

• Stripe processes payments on its hosted checkout.
• OpenRouter and the model providers process prompts and outputs to generate responses.
• Cloudflare delivers this website and sees standard request data.
• Our web host runs the servers and keeps the access logs described above.

What we don’t do

• No advertising trackers, analytics beacons or fingerprinting scripts on this site.
• We don’t sell data, buy data, or share it with advertisers.
• Your key stays in your browser tab (session storage), and it’s never put in a URL or written to our logs.

Your choices

You can stop using a key at any time by revoking it (see auth docs). To ask what we hold about a key, or to request deletion, contact us through SolaroLabs.com with “TokenCenter privacy” in the subject.

Changes

If this policy changes, we’ll update this page and the date at the top.