Privacy Policy

Depending on how you use the Services, we collect the following categories of information:

1.1 Account Information

We use Google Sign-In as the sole account authentication method. When you sign in with Google, we request your openid, email, and profile scopes and receive from Google:

• Email address - used as your account identifier and for service communications
• Display name - as it appears on your Google profile
• Profile picture URL - used as your default avatar
• Google account ID - a stable identifier that links your account to Google

We do not ask for or store an account password. You can optionally edit your display name and avatar in the console. We also store account preferences you configure, such as low-balance notification settings and your interface language.

1.2 API Keys

To call our API, you create API keys in the console. We store only a SHA-256 hash of each key plus a short display prefix; the full key is shown to you exactly once at creation and cannot be recovered. Keys are never stored or transmitted in plaintext. If you enable it, we also store the IP allowlist and quota/rate-limit settings you attach to a key.

1.3 Chat and Completion Request Data

When you call our chat, completion, or embedding endpoints, your request content (prompts, messages) is transmitted to the upstream AI model provider that fulfills the request in order to generate a response — see Section 3.1. In our own database we log only request metadata, not your message content:

• Request ID, timestamp, model requested, and upstream channel used
• Input/output token counts (including cached tokens) and computed cost
• Latency, time-to-first-token, and HTTP status codes
• Sanitized error codes and messages
• Your IP address and user-agent string (see Section 1.7)

1.4 Image and Video Generation Records

For image and video generation tasks, we store a complete task record so you can view task history in the console and so we can provide support. This record includes:

• Your prompt text and all generation parameters (aspect ratio, duration, resolution, etc.)
• References to uploaded source images or videos used as input (e.g., for image-to-video tasks)
• The result URLs of generated media and task status/error information
• The callback URL you optionally provide, which we call when an async task finishes

These records are retained for 90 days and are visible to you in the console and to SpicyRouter staff for support and abuse investigation purposes. A short-lived idempotency cache of API responses (7 days) is used to safely replay retried requests.

1.5 Media Files

Generated images, videos, and audio, together with source files you upload as generation input, are stored on Cloudflare R2 object storage and served through our CDN. These files are automatically deleted 7 days after creation. Storage URLs are not listed publicly, but anyone who obtains the link can view the file during the retention window — treat result URLs as semi-public and do not generate content containing secrets or personal information you do not want exposed.

1.6 Payment and Billing Information

We accept cryptocurrency recharges processed by NOWPayments. We do not custody your funds and never see your wallet private keys. For each payment we store:

• The order ID, amount, currency, and order status
• The one-time deposit address, cryptocurrency, and network you paid with
• The NOWPayments transaction/payment ID and timestamps
• Your resulting balance changes (recharges, consumption, refunds, gifts)

We do not collect credit card numbers or bank account details, and we do not send your email address or other personal data to NOWPayments when creating a payment.

1.7 Device, Connection, and Usage Data

We automatically collect:

• IP addresses - for security, rate limiting, fraud prevention, and API-key IP allowlist enforcement
• User-Agent strings - to identify client applications and SDKs
• Request timestamps and feature usage events - to operate, debug, and improve the Services

1.8 Communications

We send transactional emails to your account address via Cloudflare Email — for example low-balance alerts, automatic recharge results, and async-task concurrency notices — plus replies to your support inquiries. Notification preferences (such as the low-balance threshold) are under your control in the console.

1.9 Cookies and Similar Technologies

We use cookies and local storage for:

• Session management - HttpOnly session cookies that keep you signed in (essential; cannot be disabled)
• Preferences - remembering your language and dark/light theme choice
• Analytics - Google Tag Manager and PostHog help us understand aggregate usage patterns (see Sections 3.5 and 9)

We use collected information for the following purposes:

2.1 Service Delivery

• Authenticate your account and API calls, and enforce your API-key and IP allowlist settings
• Route your requests to the appropriate AI model provider and return results
• Calculate usage costs, enforce quota limits, and maintain your balance
• Store and deliver your generation task history, logs, and media results
• Call the webhook callback URL you provide when an async task completes

2.2 Billing and Payments

• Process cryptocurrency recharges via NOWPayments and credit your balance
• Maintain transaction and consumption records for accounting and dispute resolution
• Detect and prevent payment fraud and abuse of promotional credits

2.3 Safety, Security, and Abuse Prevention

• Rate limiting, IP allowlist enforcement, and fraud detection
• Investigating violations of our Terms of Service and preventing abuse of the platform
• Monitoring system performance, uptime, and error rates

2.4 Service Improvement and Analytics

• Analyze aggregated usage patterns to optimize routing, pricing, and model availability
• Identify and fix bugs or security vulnerabilities
• Develop new features based on aggregate usage trends

2.5 Communications

• Send transactional notifications (low balance, recharge results, task notices)
• Respond to support inquiries and legal requests
• Notify you of significant service, maintenance, or policy changes

2.6 Legal Compliance

• Comply with legal obligations, including tax and accounting requirements
• Enforce our Terms of Service and protect the rights, property, and safety of SpicyRouter and our users

We do not sell your personal data, and we do not share it for third-party advertising. We share data only with the categories of recipients described below, to the extent necessary to operate the Services.

3.1 Upstream AI Model Providers

Your request content and API parameters are sent to the upstream provider serving the model you selected, which may include Alibaba Cloud (Wan image/video models), ByteDance Volcengine / BytePlus (Seedream, Seedance), MiniMax, and other authorized gateway partners. They process your content as data processors/sub-processors to generate your results.

3.2 Payment Processing

Cryptocurrency payments are processed by NOWPayments according to their Privacy Policy. When creating a payment we send only the order amount, currency, and a callback URL — not your email or profile data. We never see or store wallet private keys.

3.3 Hosting and Infrastructure

The Services run on cloud infrastructure and use Cloudflare services: CDN and DDoS protection for the website/API, R2 object storage for media files, and the Email Sending API for transactional email. These providers process data on our behalf under contractual confidentiality obligations.

3.4 Identity Provider

Sign-in is handled by Google OAuth. When you authenticate, Google shares your name, email, profile picture, and account ID with us, as described in Google's privacy terms. We do not post anything back to your Google account.

3.5 Analytics Tools

We use Google Tag Manager to manage measurement tags and PostHog (proxied through our own domain) for product analytics such as page views and feature usage. These tools may set cookies or collect device and approximate location signals; see Section 9 for your cookie choices.

3.6 Legal Requirements

We may disclose your information if required by law, regulation, court order, or to protect the rights, property, or safety of SpicyRouter, our users, or the public.

We retain your data only as long as necessary:

• Account data - retained until you request account deletion
• Generated and uploaded media files - automatically deleted 7 days after creation
• Image/video generation records (including prompt text) - retained for 90 days
• Idempotency response cache - retained for 7 days
• Chat request metadata logs - retained for operational, billing, and dispute-resolution purposes; deleted upon your request where legally permitted
• Billing and payment records - retained as required by tax and accounting obligations
• Aggregated, anonymized statistics - retained indefinitely; they are not linked to your account

When data is deleted or expires, it is removed from production systems and backups in accordance with our standard backup rotation. You may request earlier deletion of your data by contacting [email protected], subject to legal retention requirements.

We implement industry-standard security measures to protect your data:

• Encryption in transit - all traffic is served over HTTPS/TLS
• Hashed API keys - keys are stored only as SHA-256 hashes; the full key is shown once at creation
• Encrypted provider credentials - our upstream provider credentials are encrypted at rest with AES-GCM
• HttpOnly session cookies - session tokens are inaccessible to page scripts
• Access controls - role-based access and least-privilege principles for staff
• Monitoring - continuous logging and monitoring for suspicious activity

Note: While we take all reasonable precautions, no system is 100% secure. You are responsible for keeping your API keys confidential and for not submitting content containing secrets or personal information you do not want processed or stored.

Depending on your location, you may have the following rights:

6.1 Access and Portability

• View your profile, API keys, balance, and billing records in the console
• View and export your chat metadata logs and generation task history from the console
• Request a machine-readable copy of your personal data by contacting support

6.2 Correction

• Edit your display name and avatar directly in the console
• Request correction of inaccurate data by contacting support

6.3 Deletion

• Delete your API keys at any time in the console
• Request deletion of your account and associated data by emailing [email protected]
• Note: some records (e.g., billing records) may be retained where required by law

6.4 Objection and Restriction

• Disable or tune low-balance email notifications in the console
• Request restriction of processing for specific purposes by contacting support

6.5 Withdraw Consent and Cookie Choices

• Manage or block analytics cookies through your browser settings or a global privacy control (see Section 9)
• Withdraw consent for optional processing at any time; this does not affect the lawfulness of prior processing

To exercise any of these rights, contact us at [email protected] with "Privacy Rights Request" in the subject line. We respond within a reasonable period and may need to verify your identity before acting on a request. If you are in the European Economic Area or California, you also have the right to lodge a complaint with your local supervisory authority.

We use the following types of cookies:

• Essential cookies - sign-in session cookies (spicyrouter.session_token, spicyrouter.refresh_token); required for authentication and cannot be disabled
• Preference cookies/local storage - your language choice (SPICYROUTER_LOCALE) and dark/light theme
• Analytics cookies - set by Google Tag Manager and PostHog to measure aggregate usage

You can control cookies through your browser settings or a global privacy control ("Do Not Track" / Global Privacy Control). Disabling analytics cookies does not affect core functionality, but disabling essential cookies will sign you out and prevent use of the console and API.