1. No logs: conversation and file content
No logs covers prompts, model responses, images, uploaded documents and text extracted from documents. We do not retain them in server-side content logs, databases or conversation history. Content is processed temporarily to fulfil your request. Generated images are held briefly in bounded memory for delivery; persistent image storage is on your client.
Because a language model must read your text to answer it, the plaintext is processed transiently in RAM during generation. We make no false claim that we 'cannot technically read' a live request — we claim, and enforce in code, that we do not persist it.
2. What we do store
Account record: an identifier (email, wallet address, or Google account id depending on how you sign in) and, for password accounts, a salted password hash.
Billing: your credit balance, an append-only credit ledger (amounts only), and per-request metadata that is content-free — a timestamp, the model name, and token counts. Never prompts, completions, images, documents or extracted document text.
Payments: amount, asset or payment method, order or transaction identifiers, payment status and subscription records where applicable. We do not store card numbers; card payments are processed by Stripe.
3. What we deliberately do not collect
No conversation content. No advertising or tracking cookies. No cross-site trackers. No sale of any data to anyone.
Your saved chat history and images are stored locally in your own browser (IndexedDB), without a server-side history or image archive. Relevant conversation content is transmitted when needed to answer a request. Clearing local data removes the client copy; signing in on another device does not restore it from our servers.
4. Website visit statistics and IP addresses
We collect website visit statistics on our own server, separately from accounts and conversation content. Records include visit time, host and page, referral/campaign source, browser/device and language, country and network. Signed-in page visits and API traffic are excluded from website visit counts. Statistics records are retained for 90 days. We do not use third-party analytics SDKs. Raw IP addresses are not stored in the statistics database. A monthly keyed hash of the IP address and browser information counts repeat visitors; while its key exists this is a pseudonymous identifier, not irreversible anonymisation. The key is held in memory and expires at the start of the next UTC month. IP addresses are also processed transiently for rate-limiting and bot protection. Statistics are not linked to account identifiers or conversation content.
5. Third parties
Cloudflare provides TLS, DNS and a Turnstile bot check at sign-up for ghostmetal.io; the Turnstile check sees your IP and a one-time token. The API address api.ghostmetal.io is served directly by our own server, TLS included: Cloudflare only resolves its name. If you sign in with Google, Google shares your email address with us and nothing else. Inference runs on hardware we own and operate.
We do not use third-party analytics or advertising SDKs.
6. Security
All traffic is served over TLS. API keys are bearer tokens — treat them like passwords; you can rotate or revoke your key at any time from your account.
7. Your controls
You can rotate your API key, change your password, and delete your local history at any time. To delete your account and its billing records, contact us.
8. Changes & contact
We will post any material change here with a new date. Questions: [email protected].