Privacy policy

1Who we are

yourbrand ("we") runs the yourbrand API and this website. We are the enterprise responsible for the personal information described here.

This policy covers the website, your account, and the API. It is short because we collect little.

2What we keep

In a database in Quebec, on hardware we own or rent and run ourselves, not a hyperscale cloud:

• Account. A username, an OPAQUE record, the hashes of your backup codes, your balance, your traceability level, and the threshold and preset you chose. An email address only if you give one. An account belongs to one person.
• API keys. A SHA-256 hash and the last four characters. The full key is shown once, when you create it.
• Usage. The key, the model, tokens or units, and the cost. A request has its own row until the top of the hour; then rows merge into totals per key and model: hourly until UTC midnight, daily until the week ends (Monday 00:00 UTC), weekly after that. It's the only trace a request leaves.
• Spent slips. The token and its value, so a slip can't be spent twice. No buyer and no redeem time. Unspent slips stay on your device, in your browser's storage or the CLI.
• Credit holds. Placed while a request runs, released when they expire.
• Plan charging. A subscription reference, only if you choose to have a plan charged automatically.
• Tax records. What we sold and the tax we collected in each province and country, kept six years. No buyer details.

3What we never keep

• Prompts and outputs. Not in logs, on disk or in the database, nor anything derived from them. They stay in memory while the model runs. The one exception is a finished video, kept encrypted and deleted with its job an hour after it completes. A hash of each conversation's system prompt and first message stays in memory for a limited time.
• IP addresses. No request or access logs, on any traffic, and an error log names no account, key or IP. An IP is checked in memory against a VPN and proxy list, then dropped.
• Payments. Adding credit only raises your balance: we don't record its amount, time or source. A transaction ID is dropped once the payment is validated. Credit is sold as $5 slips that we sign blind, so a purchase can't be tied to its redemption.
• Traceability. Only the new level, not what raised it.
• Refused requests, of any kind.

Your password never reaches us, nor a hash of it: OPAQUE checks it without it leaving your device. Card details go to the payment processor. Over Tor, your IP address doesn't reach us.

4Why we use it

Your account lets you sign in and spend credit. Usage lets us charge your balance correctly, and tax records meet our accounting obligations. With no email, notices go on the status page and your dashboard.

We do not use your data for advertising and we do not sell it.

5Retention

Your account is kept while it's open. Deleting it deletes everything about it. Exporting your credit as $5 slips also deletes it; a remainder under $5 is lost. Tax records are kept six years.

6Who else sees it

• The payment processor takes card, PayPal and Apple Pay payments. Your name, country and postal code stay with it.
• Etheroute.io takes crypto payments.
• Providers run some models, and only those whose terms rule out logging prompts. Before forwarding, we strip user, metadata and safety_identifier, and never pass your IP or headers. Every key starts in strict mode: requests go only to GPUs we run or to providers with a no-logs policy, and are refused rather than sent elsewhere. You can turn it off per key.

7What we don't protect against

If a Canadian court orders us to start recording, we comply. We can only hand over what we have. This policy doesn't protect you against:

• Being a customer at all: the payment processor knows who paid, and card statements show it.
• A plan charged automatically: your account keeps the subscription's reference, and the payment processor knows whose payment method it is.
• An order to watch one account from now on: its IP addresses and prompts can identify its owner. Only Tor or a VPN, and care about what you send, protects you.
• A preservation demand: whatever detail exists when it arrives is kept, so up to an hour of single requests, today's usage by the hour and this week's by the day.

8Your rights

You can access your personal information, have it corrected, get it in a structured, commonly used format, withdraw your consent, and be told about decisions made about you by automated processing. Most of this is self-serve from the dashboard; for anything else, write to our privacy officer. You can also complain to the Commission d'accès à l'information du Québec.

9Contact

Our privacy officer: privacy@yourbrand.sh. We reply within 30 days, usually much sooner.