Skip to main content
shuntio

Privacy Policy

Effective date:

1. Information we collect

We collect only what is needed to run a metered service and answer for a bill:

  • Account information — the email address, display name and avatar returned by Google or GitHub when you sign in. Signing in completes registration; there are no extra forms.
  • Call metadata — for each request: time, model id, the key used, input and output token counts, cached-token counts where applicable, latency, and the credit deducted.
  • Top-up records — the amount paid, the credit granted, and the time, kept for reconciliation.

2. Information we do not collect

  • We do not store passwords. Sign-in is delegated to Google and GitHub, so there is no password on this site to leak.
  • We run no advertising and set no advertising cookies, and we sell no data to brokers.
  • We do not build a profile of you across other websites.

3. Request and response content

The gateway has to read the body of a request in order to forward it. Reading is not the same as storing, and this section keeps the two apart rather than promising that nothing is ever written.

We do not keep your requests or the model responses as a record of your usage. To detect abuse — for example someone using the service to generate content that breaks our terms — an audit rule may capture a copy of a request. Those copies are kept for 24 hours and then deleted on a fixed schedule. They are never used to train models.

If you need the current retention window in writing for a compliance review, ask at the address in section 11 and we will answer specifically rather than pointing you back at this page.

4. How information is used

  • Forwarding requests to an upstream provider and returning the response.
  • Metering usage, deducting credit and producing a bill you can reconcile.
  • Detecting abuse, fraud, and attempts to bypass rate limits.
  • Answering support requests and investigating failures you report.
  • Sizing capacity from aggregate call volume — never individual profiling.

5. How information is shared

Data reaches a third party only where that is what the service is doing:

  • Upstream model providers — a request is forwarded to the provider serving the model you called. Their handling of it is governed by their own policies, not ours.
  • Sign-in providers — Google and GitHub, used only to complete OAuth sign-in.
  • Payment processors — top-ups run through third-party payment pages. We never see or store your card number.
  • Google Analytics — traffic statistics for this site. Google receives the pages you visit, the site you arrived from, coarse device and location data, and a cookie-based identifier that distinguishes return visits. None of it is linked to your account on our side.
  • Authorities — where legally compelled, and only to the extent required.

6. Cookies

The console at api.shuntio.com sets one first-party session cookie, which is strictly necessary to keep you signed in. Without it the console cannot work.

This marketing site stores one value in your browser's local storage: your light or dark theme preference. It never leaves your device and is not linked to an account.

Google Analytics 4 sets two first-party cookies, _ga and _ga_*, to tell one visit from another. They last up to 2 years and are set on every page, not only after sign-in. They carry no account information.

A visitor who does not want to be counted can block those cookies; the site works the same either way.

We set no advertising cookies.

7. Data retention

Account information, call metadata and top-up records are kept for as long as the account exists, because they are what a bill and a dispute are reconciled against.

Audit captures of request content are the exception: they are purged on the schedule described in section 3, not kept for the life of the account.

If you ask us to delete your account, we delete the account and its keys. Records we must keep for accounting or tax purposes are retained for the statutory period and used for nothing else.

8. Data security

Traffic to this site and to the API is encrypted in transit. API keys are stored hashed, shown once at creation, and can be revoked in the console at any time — revocation is immediate and does not affect your other keys.

No system can guarantee absolute security. If you discover a vulnerability, tell us at the address in section 11 before disclosing it publicly.

9. Your rights

You may access, correct, export or delete the account information we hold, and object to processing you disagree with. The console request log and billing pages already show every record tied to your account; for an export or a deletion, email us.

Depending on where you live you may also have the right to complain to a data protection authority.

10. Changes to this policy

If this policy changes, the effective date at the top of this page changes with it. A change that broadens what we collect will be announced in the console before it takes effect.

11. Contact us

Questions about this policy, or a data request: [email protected].

← shuntio