Security
What we store, and what we never do.
We keep money and access records, nothing about your content, and as little as possible about you.
Never stored, never received in plain form
- Your text, words, files or the AI model's answers.
- The encrypted requests and results (processed in memory, then discarded).
- Your encryption secret key (it never leaves your computer).
- Your name, email, card number or address (ECPay handles payment).
- Your IP address, browser or device details, or a log of individual requests.
What our servers keep
| Data | Why | How long |
|---|---|---|
| Random wallet number, balance, plan, daily cap | To know what you paid for | While you use it |
| A hash of your API key and recovery code | To check them; the keys themselves are never stored | While active; replaced keys 30 days |
| Units used per day | Daily cap and billing questions | 35 days |
| If you sign in with Google: a keyed hash of your Google account id | To find your wallet next time. We ask only for the openid scope: no name, email or photo | While you use it |
| A hash of each sign-in session | To keep you signed in on the website | 30 days, or until you sign out |
| Encryption evaluation keys | Let our server compute on your encrypted data; they cannot decrypt anything | 30 days |
| ECPay order number, USD price and the NT$ amount charged | To match a payment to a wallet, and for disputes | Credit packs: 120 days; plans: until cancelled |
Dates are kept as days, not times. A copy of our database would show random wallet numbers and balances, not who you are or what you wrote.
On your computer
- The link between each placeholder and its real value, in memory only, per conversation.
- Statistics for your dashboard: counts and categories, with masked previews you can turn off.
- Your API key, in the system keychain (macOS Keychain, Linux Secret Service), or a file only you can read.
If your API key leaks
- The key can only spend units, up to its daily cap. It cannot read anything: there is nothing readable to read.
- If a copy of a
bh_live_key is published on GitHub, it is revoked automatically. - Use your recovery code on the account page to get a new key. Your balance stays.
Limits we are honest about
- No masking is perfect. We publish our measured accuracy, including what we miss.
- ECPay knows who paid. Our records do not link a wallet to a person, except the ECPay order number kept for renewals and disputes.
- Cloudflare, which runs our network edge, sees connection addresses as any website host does.