Trust
Use it without telling us who you are.
Sign up without an email, top up with slips that can't be traced back to your payment, and use the site and API over Tor. Here's how each piece works; the privacy policy has the fine print.
We sign every slip without seeing it, so nothing on a slip ties it to the payment that bought it.
Service policies
What holds for every account.
01Your data
- Prompts never stored
- On every model. Prompts and outputs are never stored, except finished videos, kept encrypted and deleted an hour after they complete.
- No request logs
- On any traffic: no request logs, no access logs, no IP addresses. An error log names no account, key or IP.
- Complete deletion
- Deleting an account deletes everything about it.
02Your identity
- Passwords we never see
- Built on OPAQUE, an open standard for checking passwords: yours is checked without ever leaving your device, not even as a hash.
- No hyperscale cloud
- The database runs in Quebec, on hardware we own or rent and run ourselves, not on a hyperscale cloud.
- On Tor
- The site and the API are also on Tor: use them there and your connection to us never leaves the Tor network. See On Tor below.
03Your payments
- Card details never reach us
- Card, PayPal and Apple Pay go through a payment processor; crypto goes through Etheroute.io.
- Payment IDs not kept
- Once a payment is validated, we don't keep its transaction ID.
- Bank-verified payments
- Where a payment method supports it, your bank verifies the payment (3-D Secure).
Traceability
Your traceability, measured.
Every account has a traceability level. It starts at zero, the lowest, and rises only when you do something that could tie the account to you, like adding an email. We keep the level, never what raised it.
When you sign up, you pick a preset: Standard, Hardened or Maximum. It sets your warning level, where we warn you and pause your requests, and the stricter presets switch off the riskiest choices entirely. You can change it later.
Reach your warning level and a yellow banner appears on every page, and by default your requests pause until you decide what to do.
- Signing up with a username you chooseRaises itNot allowedNot allowed
- Signing up with an email addressRaises itRaises itRaises it
- Signed in without a VPN or proxyRaises itRaises itRaises it
- Signed in on the regular web, not over TorRaises itRaises itRaises it
- Adding a slip to your balance soon after signing up, or when it runs lowRaises itRaises itRaises it
- Buying credit while signed inRaises itRaises itNot allowed
- Having a plan charged automaticallyRaises itRaises itNot allowed
The banner every page shows once you reach your warning level.
Credit slips
Slips that can't be traced back to your payment.
- Credit is sold as $5 slips: prepaid vouchers, each added to your balance once. You buy them in multiples of $5.
- Here's the trick. Your browser seals each slip in an envelope only it can open. We sign the envelope after you pay, without ever looking inside, and your browser opens it. When you add the slip to your balance, we can check our signature, but nothing on the slip tells us which payment it came from. It's built on Privacy Pass, an open internet standard.
- Every slip is signed with the same published key, and your browser and the command-line tool reject any slip signed with another, so yours look like everyone else's.
- Buy them signed out, on a separate site, and the slips are simply handed to you. Buying while signed in also works where your preset allows it, after a warning, but it raises your traceability.
- Your browser keeps your slips. Clearing cookies or site data erases them, so export a copy somewhere safe; you can import it into another browser or the command-line tool.
- Slips can add themselves to your balance at random moments, so your balance doesn't go up right when you pay. We don't store when a slip was added.
- An optional command-line tool keeps your slips and adds them to your balance around the clock.
Sealed envelopes cut the link between paying and topping up; random timing keeps the two apart. We keep each used slip, never when it was added.
Rolling accounts
Start over without losing your credit.
- 01Sign up with only a username
You get backup codes instead of an email. Lose them along with your password and the account is gone for good; you agree to that before it's created.
- 02Turn your balance into slips
Your balance leaves as $5 slips, anything under $5 is lost, and the account is deleted for good.
- 03Open a fresh account
Add the slips to it over time, ideally at random moments, and nothing we keep connects the new account to the old one.
On Tor
Tor, all the way to us.
- The site and the inference API also have their own Tor addresses: connect there and your connection to us never leaves the Tor network.
- Rate limits are per account, never per IP address; over Tor, your device solves a small puzzle instead.
- The command-line tool talks only to our Tor address. It's open source: read it, build it yourself, and see exactly what it sends.
Payments
Two ways to pay, and card details never reach us.
Through a payment processor. Your card details, name, country and postal code stay with them, never with us, and your bank verifies the payment where it can.
Through Etheroute.io: Bitcoin, Ethereum and its L2s, Solana, Litecoin, stablecoins like USDC and USDT, and more.
- Pay signed out and you get slips to add to your balance whenever you like. Pay while signed in and they go straight into your balance, which raises your traceability.
- Monthly plans are paid from your credit and fall back to pay-as-you-go when your balance can't cover them. You can have a payment method charged automatically instead, but that ties it to your account and raises your traceability a lot, so some presets don't allow it.
Refunds
Nothing is refunded, whatever the payment method, including when an account is closed. Before closing one, you can export its credit as $5 slips; a remainder under $5 is lost.