Privacy

What the gateway stores, as implemented:

• Account: email address and a password hash (held by the authentication provider).
• API keys: name, project, a hash of the key, creation and last-used times.
• Request metadata: time, route, model, status, latency and token counts when reported. Prompts and responses are not stored.
• Security events: hashed IP addresses for repeated invalid-key attempts.

Requests are forwarded to a model provider to produce responses. The operator must add a full privacy policy before public launch.