Privacy policy

Who is responsible

ChadRouter is operated by an individual sole proprietor who is responsible for the information described in this policy. For privacy questions or requests, email [email protected].

Information we process

• Account information: your name, email address, Google account information used for login, and authentication and session records.
• API access and usage: API key names, prefixes and hashes, model and request identifiers, request status, timestamps, token counts, latency, credit balances, reservations and charges. API keys are shown when created; we store hashes for authentication rather than the full key.
• API content: the prompts, messages and other request content you submit, and the generated response needed to fulfill the request.
• Support and payment records: messages and information you send to support, and purchase or refund references needed to manage payments.
• Technical information: hosting, authentication and security providers may process IP addresses, browser information and request metadata to deliver and protect the service.

Why we use it

We use information to authenticate you, provide API access, route model requests, calculate usage and balances, investigate billing issues, prevent abuse, secure the service, respond to support requests and meet applicable legal obligations.

Where a legal basis is required, we rely on providing the service you request, legitimate interests in operating and protecting it, compliance with legal obligations, or consent where required. The basis depends on the information and purpose.

Prompts, responses and model vendors

Requests are transmitted to the model vendor needed to produce a response. ChadRouter does not persist prompt or completion bodies in its application database or usage records, and content logging is disabled in its model gateway.

This is not a promise that upstream model vendors do not retain content or use it for training. Vendor data practices can differ. Contact us before sending sensitive or regulated information if you need to confirm the handling for a particular model. Do not send secrets or personal data you do not have authority to process.

Service providers and disclosures

We use Cloudflare for website delivery, security and email routing, Convex and Better Auth for account and application data, Google for sign-in, hosting providers for the API, model vendors for inference, and email providers for support correspondence.

Dodo Payments processes purchases as merchant of record under its own privacy notice. Payment details entered on its payment page are handled by Dodo Payments and its payment partners; do not send card details to ChadRouter support.

We may also disclose information when required by law, to protect rights or security, or as part of a lawful transfer of the service. We do not sell personal information. Providers may process information in countries different from yours; where required, applicable safeguards govern those transfers.

Cookies and sessions

We use authentication and session cookies to keep you signed in and protect account access. Google and other providers may set cookies on their own services. Blocking authentication cookies may prevent login.

Retention and security

We retain account, usage, billing and support records as needed to provide the service, reconcile charges, resolve disputes, prevent abuse and meet legal obligations. Retention depends on the record and purpose; we do not promise immediate removal from backups or records we must retain.

Access controls, authenticated connections and hashed API keys help protect information. No system is completely secure. Revoke exposed keys and contact support if you believe your account has been compromised.

Your choices and rights

You can revoke API keys in the console and stop using the service at any time. Email support to request account closure or to ask to access, correct or delete personal information.

Depending on your location, you may also have rights to a copy of your data, to object to or restrict processing, to withdraw consent, or to complain to a data protection authority. We may need to verify your identity and may retain information where the law permits or requires it.

Children and policy updates

ChadRouter is intended for adults aged 18 or older. Contact us if you believe a child has provided personal information. We will publish changes to this policy here and communicate material changes through the service or your account email.