$ cat /privacy.md
The short version: we store as little as the product allows, we never store your prompts, and your provider keys are encrypted at rest in a way even we can’t casually read.
last updated: August 27, 2026
- ›Accounts: email, a salted scrypt password hash, optional display name, your referral code, trust points/level and role. No social logins, no profile scraping.
- ›Referral & check-in data: referral relationships and, to detect fraud, coarse IP and device/user-agent strings captured at signup, check-in and referral events.
- ›Compute ledger: an append-only record of every compute grant and spend (amount, type, timestamp, balance after). Ledger integrity is the point — entries are never silently rewritten.
- ›Evidence uploads: screenshots and text you attach to bounty submissions. Images are fingerprinted with a perceptual hash (a low-frequency image digest) so the same screenshot can’t be resubmitted across bounties. Fingerprints persist after review to prevent duplicate farming; originals are retained with your account.
- ›Fraud signals: IP/device clustering across check-ins, referrals and submissions. These signals are used only to flag abuse (self-referrals, multi-account farming) and are reviewed by a human before any enforcement action.
When you connect a provider to the gateway (BYOK mode), your provider API key is stored encrypted at rest using AES-256-GCM envelope encryption: each key is sealed with a unique data-encryption key, which is itself wrapped by a master key kept outside the database. Concretely:
- ›Keys are never returned in plaintext after saving — the dashboard shows only a hint (e.g. the last 4 characters).
- ›Keys are never written to logs, request records, or error traces.
- ›Keys are decrypted only in memory, only when a request you initiate needs to reach that provider.
- ›Keys are revocable at any time from your dashboard; deletion removes the ciphertext immediately.
Gateway request records contain metadata only: requested model, upstream provider, token counts, HTTP status, latency and the compute charged. Prompt bodies and provider keys are excluded from logging by default and are never persisted. Short error snippets (a provider’s own error message, e.g. a rate-limit notice) may be kept to help you debug a failed route; if an error snippet ever contains request content it is truncated at the source before storage.
We use one essential cookie (upr_session) to keep you signed in — it is httpOnly and functionally required. For advertising we use Google AdSense. On your first visit you’ll see a consent banner where you can accept or decline ads: the ad runtime (and any advertising cookies) load only after you accept. Choosing “essential only” keeps the ad runtime off for your visit. Ads keep the directory free to read; you can change or withdraw your choice at any time (it resets when you clear site data) or via your browser’s ad/tracking settings. Aggregate traffic measurement may use privacy-preserving counters without building advertising profiles ourselves.
- ›Providers you route to: when Uprouter Connect forwards a request, the upstream provider processes it under their own privacy policy. We forward the minimum payload required. This is exactly why complying with each provider’s terms is your responsibility — see our terms.
- ›No payment processor: listing submission is free and inclusion is an editorial decision on the merits, never sold — we collect no card data and operate no paid listing flow.
- ›Google AdSense: advertising, subject to the consent choices described above.
We do not sell personal data, and we do not share it with data brokers.
- ›Sessions expire after 30 days of inactivity.
- ›Gateway request metadata is retained for 90 days for abuse metering, then aggregated or deleted.
- ›The compute ledger is retained for the life of the account for balance integrity; on deletion it is anonymized, not silently erased, so historical totals remain consistent.
- ›Perceptual-hash fingerprints of bounty evidence persist after review to keep bounties farm-resistant.
To delete your account and associated personal data, email contact@uprouter.online from your account address. We process deletion requests within 30 days and confirm by email. Entries you authored publicly (reviews) can be removed on request; anonymized ledger lines remain for integrity.