Privacy policy.
Last updated · June 2026
1. What we collect
- Account data: email and display name received from your OAuth provider (Google / GitHub).
- Billing data: deposit addresses and on-chain transaction hashes when you top up credits with cryptocurrency.
- Usage metadata: for each inference request — timestamp, model used, token counts (prompt + completion), latency, request id, status, API key id.
- Operational logs: IP addresses and user-agent strings for rate-limiting and abuse detection, retained for 30 days.
2. What we do NOT collect by default
- Prompt content (the messages you send).
- Completion content (the model's response).
If you opt-in to debugging or run an investigation with our support, we may temporarily enable request body capture for your account. We'll always tell you when this is on.
3. Upstream providers
Each inference request is forwarded to a third-party AI provider (e.g. Novita AI, Together AI, Hyperbolic). Those providers see the prompt and may retain it per their own privacy policies. We do not control upstream retention. Check the provider's policy before sending sensitive data.
4. Cookies
We set first-party cookies only:
access_token,refresh_token— your authenticated session (HttpOnly, Secure, SameSite=Lax).
No analytics cookies, no third-party trackers.
5. Sharing
We share data with: (a) upstream AI providers as needed to fulfil requests, (b) payment processors when you top up via card, (c) infrastructure providers (hosting, observability) bound by data processing agreements. We do not sell personal data.
6. Your rights
You can: export your account data, delete your account, revoke API keys at any time via the dashboard. For GDPR data access or deletion requests email privacy@cocolada.xyz.
7. Security
API keys are stored as bcrypt hashes (cost 12). JWTs use RS256. Data in transit is TLS 1.2+. Postgres backups are encrypted. We follow the principle of least privilege internally.
8. Changes
We'll update the "Last updated" date when this policy changes. Material changes will be announced via email to registered users.