Privacy Policy

1. What we collect

Account data: email address, name, avatar and sign-in provider (email code, GitHub or Google).

Usage data: for hosted models, the model, token counts, cost and time of each request, so we can enforce limits and show your usage. We do not store prompt or response content of hosted requests beyond what is needed to deliver them, except short-lived logs for abuse and debugging (kept up to 30 days).

Billing data: plan, subscription status and invoices. Card and payment details are collected and stored by Paddle, not by us.

Settings you choose to sync, saved provider keys (encrypted), support messages you send us, and technical data (IP address, browser and app version) for security and error reports. Error reports never include your code, prompts, keys or tokens.

2. Why we use it (legal bases)

To provide the Service and your plan (contract); to secure the Service, prevent abuse and fix errors (legitimate interests); to send account, security and billing messages (contract); and to meet tax and legal duties (legal obligation). We do not sell personal data and do not use it for advertising.

3. Who we share it with

Service providers acting for us: Paddle (payments, tax, invoices; Paddle is an independent controller for payment data), our hosting and database providers, our email provider, the model providers that run hosted requests (only the content of the request you send), and an error-tracking service (scrubbed technical data). We share data with authorities only when the law requires it.

4. International transfers

Data may be processed outside your country, including in the EU, the UK, the US and Israel (which has an EU adequacy decision). Where needed we use standard contractual clauses or equivalent safeguards.

5. Retention

Account data is kept while your account is open and deleted within 30 days after you delete it. Usage records are kept up to 24 months. Billing records are kept as long as tax law requires (usually 7 years).

6. Cookies

We use only essential cookies: your session, and your theme and language choices. We do not use analytics, tracking or advertising cookies, so no cookie consent banner is shown. Paddle may set its own cookies during checkout.

7. Your rights

Depending on where you live (including under the GDPR, the UK GDPR and the Israeli Protection of Privacy Law) you can ask to access, correct, delete or export your data, and to object to or restrict processing. Write to support@ingot.dev. You can also complain to your data protection authority, for example the Israeli Privacy Protection Authority or your local EU authority.

8. Security and children

We use encryption in transit and at rest for keys and tokens, access controls and audit logs. The Service is not directed to children under 16.

9. Changes

We will post updates here and, for material changes, tell you by email or in the portal.