Privacy Policy

Last updated: 24 October 2026

Summary

We collect what we need to run your account, charge for requests and keep the service safe. We do not sell your data and we do not use advertising or analytics trackers. API prompts and replies pass through to the model provider and are not stored by us; chats you save in the playground are stored in your account.

What we collect

• Account: your username, email address and a scrypt hash of your password (never the password itself). If you sign in with Google or GitHub, we receive your email address from them.
• Usage: for each API request we record the key used, the model, token counts, cost, status and response time. This is what you see under Usage and Billing.
• Playground chats: conversations you keep in the playground are saved to your account so they appear on your other devices. You can delete them at any time.
• Payments: the coin, network, amount and transaction ID of your top-ups. Blockchain transactions are public by nature.
• Security: a one-way hash of the IP addresses you sign up and sign in from, used to stop abuse and enforce bans.
• Support: messages you send us by email or Discord.

Prompts and model providers

To answer an API or playground request we send your prompt to the provider that serves the chosen model, and the reply comes back through us. We do not keep API prompts or replies. The provider handles them under its own privacy policy and terms; some providers, especially for free models, may log requests or use them to improve their models. Do not send personal or confidential data you are not comfortable sharing with the model's provider.

Cookies and local storage

We use one essential, HttpOnly session cookie to keep you signed in, and your browser's local storage for preferences such as the selected model. There are no advertising or tracking cookies. Our pages load fonts from Google Fonts and a badge image from LMSpeed, which means those services see your IP address when the page loads.

Where data is stored

ExosAI runs on servers in the United States (Oracle Cloud). Encrypted backups are kept with the same provider. Account emails are sent through Cloudflare.

How long we keep it

Account, usage and payment records are kept while your account exists. When you delete your account in Settings, your account, keys and saved chats are removed; we may keep payment and abuse-prevention records (such as hashed IP addresses of banned accounts) where needed to prevent fraud or meet legal duties. Backups roll over and expire on their own.

Your choices

You can see your usage and payments in the dashboard, delete saved chats, revoke API keys and delete your account in Settings. To ask for a copy of your data or for anything you cannot do yourself, email support@exosai.tech.

Changes

We may update this policy. The date at the top shows the latest version.