What we log

One row of metadata per API call. That is all:

which account and key, and whether it came from the API or the chat app
endpoint and model
prompt tokens, completion tokens and cost
latency, time to first token and HTTP status
which inference node served it
an error message, when the call failed. This is a short error string from the engine, not your prompt.

What we do not log

Message text, system prompts, tool arguments or model output. They are not written to our database.
Web search queries made through the search API.
Files, images or anything else you send.

Request bodies pass through the gateway in memory on their way to the model, and the response comes back the same way. Nothing is kept once the connection closes.

Retention

30 days by default. Request metadata older than that is deleted.
365 days if you opt in under Dashboard, Settings (log retention), if you want a longer usage history.
Deleting your account removes it all.

The ledger of credits you bought and spent is accounting data and is kept as long as the account exists.

The chat app

Conversations in the chat app are stored in your browser, on your device. They are not on our servers, so we cannot recover them, and clearing site data deletes them. The messages are sent to the model for each reply, like an API call, and metered the same way.

Where text does leave

The model engines that run your request receive the prompt, naturally.
With web search on, the query (derived from your last message) goes to our search provider.
With scrape, the URL you give us is fetched from our side.

The full policy is on the privacy page, and the one acceptable-use rule set is in the terms. You can wipe your account from Dashboard, Settings.