privacy policy

stated plainly, not buried · home · usage guide

This is the whole bargain on one page. The core of it is on the front page too, on purpose: free conversations feed a public corpus; paid conversations stay private. Everything below is the detail.

Who runs this

What we collect

• Your prompts & the model's replies — to actually serve inference, and (free tier) to build the open corpus.
• Usage metadata — timestamps, token counts, model, tier, coarse rate-limit signals. Used to run, secure, and report on the service (see the almanac).
• Account & billing — for paid tiers: your email and subscription status. Card data is handled entirely by Stripe; we never see or store card numbers.

The dogfeed bargain (the important part)

• Free tier (design): free conversations are intended to feed the public ultrawhale-dogfood corpus, PII-scrubbed. Honest state: free-traffic capture isn't live yet — the corpus is currently fed by our own generation loop, not by tapping your prompts. When capture goes live you'll opt out per request (X-Vaked-Dogfeed: off).
• Paid tiers: private by default. Nothing is published unless you explicitly opt in (which earns −€3/mo).

PII scrubbing is best-effort automation, not a guarantee. Never paste live secrets, tokens, passwords, or another person's personal data into a free-tier prompt.

Legal basis (GDPR)

• Contract (Art. 6(1)(b)) — running your paid subscription and serving your requests.
• Consent (Art. 6(1)(a)) — publishing conversations to the public corpus (free-tier default, revocable by opting out; paid opt-in).
• Legitimate interest (Art. 6(1)(f)) — keeping the node up, secure, and abuse-free.

Who else touches the data

International transfer: the node currently runs in the United States. By using it you accept that your requests are processed there. EU-region hosting is on the roadmap.

Retention

Once a free-tier conversation is PII-scrubbed and published, it is public and permanent by design. Un-published raw logs are kept only as long as needed to run and secure the service, then discarded. Billing records are kept as long as tax law requires.

Your rights

You may request access, correction, deletion, a copy (portability), or object to processing, and withdraw consent at any time — email the contact above. Note the one honest limit: data already published to the open corpus cannot be recalled from everyone who copied it, though we will remove it from the dataset we publish.

Security

TLS everywhere (Let's Encrypt); the box is firewalled to SSH/HTTP/HTTPS only; API keys live in an access-restricted store on the box (readable only by the service user); the Stripe payment webhook is cryptographically signature-verified; and the box never holds the Stripe secret key — only the webhook signing secret.