# Privacy policy

> What we keep about you, where your prompts go, and your choices.

Effective October 20, 2026 · Version 1.6

## At a glance

- **Prompts:** We never store the text of your prompts or the model's responses. Images an app generates through MCP stay for 24 hours.
- **Routing:** Your prompt passes through OpenRouter to the model's provider, which keeps data under its own policy.
- **Requests:** We keep a record of every request: model, tokens, cost, API key, client and time.
- **Chain activity:** Your wallet activity on Ethereum is public, and nobody can delete it.
- **Deletion:** Deleting your account clears your name and email and disables your API keys. Request records stay.
- **Tracking:** We run no analytics or advertising, and we never sell personal data.

## 1. Who this covers

This policy covers three groups:

- **Account holders**, who sign in.
- **Token holders**, whose wallets hold tokens whose chain records Deference indexes. You may never sign in, but indexed addresses, balances and reward amounts can appear in public records.
- **Visitors**, who read the site without signing in. We store nothing about you.

Deference is for people aged 18 and over.

## 2. What we keep

| What | Why | How long |
| --- | --- | --- |
| **Your account:** wallet address, display name, email, sign-up time and credit | Runs your account | Name and email until you delete the account; the rest stays |
| **Sign-in identity:** Privy user ID, email in normalized form, Google account ID | Gives free credit once per person, and opens the same account for every sign-in method | Kept after deletion |
| **Linked wallets** | Credits activations and claims from any of your wallets | Kept after deletion |
| **Sign-in sessions:** session ID, first and last use | Lets you sign out everywhere | 35 days after last use or sign-out |
| **API keys:** name, first and last four characters, a hash, limit, expiry, last use | Checks requests without storing the key | Kept, marked deleted |
| **Request records:** time, model, provider, endpoint, API key, token counts, cost, status, speed, and the client name and coding-session ID your tool sends, except on Incognito requests | Billing, Activity, Usage and network statistics | No end date; kept after deletion |
| **Agent tool calls:** which tool a connected app or API key called, when, how it ended, the request it started and its cost, and for paid calls the retry key the app chose and a one-way hash of the inputs, keyed with a server secret on Incognito runs. Never the inputs or outputs | Shows each app's activity in Agents and makes paid calls safe to retry | 90 days |
| **Generated images:** images a connected app generated through MCP | Lets the app download the file | 24 hours |
| **Credit records:** activations, charges and free-credit grants | Keeps the books | No end date |
| **Chain records we copy:** purchases, activations, transfers, order book events, reward payouts and claims, holder balances, and other public token events | Shows your history and rewards | No end date; public on Ethereum anyway |
| **Records from retired features:** token details, uploads, wallet permissions and actions saved by features no longer offered | Keeps a record of what was submitted | No end date; kept after deletion |
| **Network statistics** | The Stats and Status pages | Totals only. A model or tool appears by name once it has 50 requests from 5 accounts. |

## 3. What we never keep

- The text of prompts and responses.
- Full API keys.
- IP addresses. We use them in memory for rate limits and never store them; our hosting provider sees the address your connection comes from.
- Passwords or card details. Deference has neither.

We run no analytics, advertising or session-replay scripts, and we never sell or rent personal data. Privy's sign-in code keeps its own analytics ID ([Who receives data](https://deference.si/privacy#recipients)). Everything stored in your browser is listed in [Cookies and storage](https://deference.si/cookies).

## 4. Where your prompts go

Deference sees each prompt in passing and keeps only the record.

1. Your tool sends the request to Deference with your API key. We check the key and your credit and hold the cost.
2. We forward the request to OpenRouter. On chat completions, embeddings and images we add an account tag: the first 32 characters of a SHA-256 hash of your account ID, never your name, email or address. On Messages and Responses the body goes exactly as your tool sent it, with any identifiers your tool put in it. Incognito requests get no account tag.
3. OpenRouter sends it to a provider that runs the model. OpenRouter keeps request metadata and stores prompt text only for accounts that turn logging on; it may sample a small share of prompts to categorize them without identifying anyone. Each provider keeps, and may train on, prompts under its own policy. Outside Incognito, Deference does not restrict which providers OpenRouter chooses.
4. A model id ending in `:incognito` runs only on Phala's confidential-computing hardware, with zero-data-retention routing and no fallback. We strip caller identifiers, and refuse plugins, web search, server tools and files rather than forward them. Deference and the routing service still handle the request in transit. The provider is reported per request, not proven by a receipt.
5. The response streams back to you. If you disconnect, the provider still finishes and we keep reading until it does, so the request is charged in full.

Read a provider's policy before you send it sensitive data. OpenRouter's is at [openrouter.ai/privacy](https://openrouter.ai/privacy).

## 5. Who receives data

| Company | What it receives | Why |
| --- | --- | --- |
| OpenRouter | Prompts and outputs in transit, the account tag, our site name | Routes requests to models |
| The model's provider | Prompts and outputs | Runs the model |
| Privy | Email, Google profile, linked wallets, passkeys, IP address and device details, and a client analytics ID its code stores on your device | Sign-in and embedded wallets |
| Google | The standard sign-in exchange, when you choose Google | Sign-in |
| Our Ethereum RPC provider | Your IP address and the addresses your browser reads, because your browser calls it directly | Reads and sends chain data |
| Our hosting provider | Everything in [What we keep](https://deference.si/privacy#keep), and connection logs | Runs Deference |

**Across borders.** OpenRouter, Privy and Google are based in the United States, so your data goes there.

**Authorities.** We share data with authorities only when the law requires it.

## 6. Your chain activity is public

Purchases, activations, transfers, swaps, order book actions and reward claims are Ethereum transactions. Anyone can see them, link them to your address and keep copies, and we cannot change or delete them. Activation records the burning wallet, recipient and credit after any activation fee.

Reward payouts and claims are on chain, and the DEFERENCE token's records show what each wallet has been assigned, has claimed and can claim.

## 7. How we use data

- Run the API and the dashboard, and show your activity · contract
- Charge requests and settle credit · contract
- Give free credit once per person · legitimate interest
- Show reward payouts and claims · legitimate interest
- Keep records from retired features · contract
- Publish network statistics, folded as in [What we keep](https://deference.si/privacy#keep) · legitimate interest
- Stop abuse and enforce the [acceptable use policy](https://deference.si/acceptable-use) · legitimate interest
- Keep the books the law requires · legal duty

## 8. Deleting your account

**Delete account** is in Settings; you confirm by typing your address. It waits until none of your requests is running.

**Removed:** every API key is disabled and marked deleted, your name and email are cleared, every session ends, and all credit is given up.

**Kept:** the account with its wallet address, request and credit records, your sign-in identity, your linked wallets, and records from retired features. Agent tool calls and generated images stay until their retention ends. Billing and service statistics depend on the records, and the identity stops the same person collecting free credit twice. Signing in again opens the same account. It has no keys or credit, but it still has its linked wallets and records from retired features.

**At Privy:** your Privy account is separate. To delete it too, write to [support@deference.so](mailto:support@deference.so) and we will delete it through Privy.

## 9. Your rights

You can see, correct, export and delete your data, object to how we use it, and complain to your data protection authority.

**Correct:** change your display name in Settings.

**Export:** Usage has a CSV download of your requests.

**Delete:** see [Deleting your account](https://deference.si/privacy#deleting).

**Anything else:** write to [support@deference.so](mailto:support@deference.so) from the email on your account. If your account has no email, we ask you to sign a message with its wallet. We answer within one month.

## 10. How we protect data

- API keys are stored as SHA-256 hashes and shown once.
- Your session lives in an encrypted cookie that page scripts cannot read, and **Sign out everywhere** ends every session.
- All traffic uses TLS.
- Contract roles restrict INFERENCE minting and sale pausing. Administrators can upgrade the INFERENCE and sale implementations.
- If a breach affects your data, we tell you by email where we have your address, and on this site.

## 11. Changes and contact

Each new version is published here with its effective date and listed in the version history below. Questions go to [support@deference.so](mailto:support@deference.so).

## Version history

- October 20, 2026 · 1.6 · Describes reward records and contract roles as the DEFERENCE token works.
- October 18, 2026 · 1.5 · Adds Incognito: Phala-only routing, what it strips and refuses, and the records it leaves out.
- October 18, 2026 · 1.4 · Adds agent tool calls and generated images; groups records from retired features.
- October 18, 2026 · 1.3 · Clarifies coverage of retained token and wallet records.
- October 17, 2026 · 1.2 · Adds retained token details and logos, authorized wallets, quotes and actions, and chain records.
- October 15, 2026 · 1.1 · Adds order book records, describes payout data files and upgrade roles, and says deleted API keys are disabled and marked deleted.
- October 9, 2026 · 1.0 · First published version.

Questions: support@deference.so