Privacy Policy

1. Collection of Personal Data

Information You Provide

You sign in with Discord, which gives us your Discord ID, username, display name and verified email address. We also check whether you are a member of our Discord server each time you sign in. If you make a purchase or contact support, we receive the details you share. Payments are handled by Creem; we receive confirmation of a transaction and its amount, but we never receive or store your card number. If you follow an invite link, we note who invited you. We handle the content of the prompts you submit only for the limited purpose of routing them to the AI model provider you have selected.

Information Collected Automatically

For your sessions and security logs, we record your IP address and browser details, and we keep a keyed hash of your sign-up IP address to limit abuse. Usage logs do not contain your IP address. For each API request we record operational metadata such as the model requested, token counts, cost, latency, whether the request succeeded, and technical details your app sends, such as its user agent or origin. This metadata is what powers your usage logs and billing. We do not store the content of your requests or the responses.

Cookies and Tracking Technologies

We use cookies and similar technologies to keep you signed in, to remember who invited you if you followed an invite link, and to remember your preferences. Strictly necessary cookies hold your session and authentication state and cannot be disabled without breaking the service. Preference cookies remember settings such as your theme and selected model. The chat also keeps your conversations and settings in your browser's storage. We do not use cookies or similar technologies for analytics or advertising. You can block or delete cookies in your browser settings, but parts of the service may stop working.

2. How We Use Your Personal Data

We use the information we collect to provide and maintain our services; to route your requests to the AI model provider you select and return the response; to maintain your credit balance; to send you technical notices and security alerts; to respond to your questions and support requests; to detect, investigate, and prevent fraud, abuse, and other illegal activity; and to comply with legal obligations. We do not use the content of your prompts or the responses you receive to train AI models, we do not sell your personal information, we do not send marketing email, and we do not use analytics or advertising trackers.

3. How We Share Your Personal Data

We share your information only where it is necessary to run the service or where the law requires it. AI model providers: when you send a request, its content is transmitted to the upstream provider that serves the model you chose, without your IP address, your account data or your adorouter key. Each provider handles data under its own terms, and some may retain or train on what they receive. Payment processing: Creem, our merchant of record in Estonia, processes purchases under its own privacy policy. Sign-in: Discord handles sign-in under its own privacy policy. Infrastructure providers: hosting and content delivery vendors process data on our behalf. Legal and safety: we may disclose information where required by law, or where we reasonably believe disclosure is necessary to enforce our terms, investigate abuse, or protect the rights and safety of our users or the public. Business transfers: if adorouter is ever sold or merged, your information may be transferred as part of that transaction.

4. Sharing with Model Providers That Use Inputs for Training

adorouter offers some models through providers that also use your inputs for their own purposes (in particular to train their models). Providers that have not published how they handle inputs are treated in the same way, because it cannot be ruled out that they use inputs for their own purposes. These providers process the data under their own responsibility. adorouter shows you which models and providers are affected when you choose a model. Passing your inputs to these providers is based not only on the performance of the contract but also on our legitimate interest in offering you the widest possible choice of AI models, including models that are only available on these terms (Art. 6(1)(f) GDPR). You choose the model yourself and are informed of the training use beforehand. Models without training use are available to you at any time. We only transmit the content of your input, not your account data, your IP address or any other identifiers. You must not enter special categories of personal data within the meaning of Art. 9(1) GDPR, such as health data or data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or sex life, into models with training use. Our legitimate interest does not extend to such data.

Right to object: You may object at any time, on grounds relating to your particular situation, to your inputs being passed to these providers (Art. 21(1) GDPR). After an objection, we no longer forward your inputs to these providers. You can declare your objection on the Consents page or by email to [email protected].

5. Your Rights and Choices

Depending on your location, you may have rights over your personal data, including the right to access it, correct it, delete it, receive a portable copy, object to or restrict certain processing, and withdraw consent where our processing relies on it. You can see your usage, manage your API keys and delete your account in the application. To exercise any right that is not available in the application, contact us at [email protected]. We may ask you to verify your identity before we act, and we will respond within the time limits set by applicable law. Deleting your account removes your account details, API keys, sessions and usage logs. We keep payment records as long as tax law requires, security log entries with your name, IP address and browser details removed, and a keyed one-way fingerprint of your Discord ID, so the same Discord account cannot claim the free credit twice.

6. Data Security

We implement and maintain reasonable security measures to protect your personal information. Traffic is encrypted in transit, API keys are stored encrypted so that you can view them again in your dashboard, session cookies are HTTP-only, and access to production systems is restricted. Your API keys are credentials: anyone holding one can spend your balance, so keep them secret and revoke any key you believe has been exposed. No method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

7. Third-Party Services

Our services link to and integrate with services operated by other companies, including AI model providers, Creem and Discord. We do not control how those companies handle your data, and this Privacy Policy does not apply to them. We encourage you to read their policies before sharing information with them. The chat may download language model tokenizer files from Hugging Face to estimate message sizes; this sends no prompts, but Hugging Face sees your IP address, as with any download.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. Usage logs are kept for a limited time and then deleted. Your chat history is stored locally in your own browser rather than on our servers, so clearing it in the application or clearing your browser storage removes it. Prompt content passed to a model provider is retained by that provider according to its own policy, not ours. Records of consents to models with training use and other models that require consent, including the text you agreed to, are kept while your account exists and for up to three years after the consent ends, so that we can prove it. An objection you declare is stored as an account setting for as long as your account exists. When we no longer need data, we delete or anonymize it. Encrypted backups of our database are kept for up to 30 days, so deleted data can remain in a backup until that backup expires.

9. Age Requirements

Our services are not directed to children. You must be at least 13 years old to use them, and old enough to enter into a binding contract in your country of residence, or have the permission of a parent or guardian. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it. If you believe a child has provided us personal data, contact us at [email protected].

10. International Data Transfers

Your personal data may be transferred to and processed in countries other than your country of residence. For our own infrastructure, we transfer personal data out of the European Economic Area only where an adequacy decision of the European Commission covers the destination country or where standard contractual clauses approved by the European Commission are in place. Model providers are a separate case. Requests to DeepSeek models are served by DeepSeek in China, a country for which no adequacy decision exists. The level of data protection there is not comparable to that in the European Union: authorities may have far-reaching powers to access data, and you may not have equivalent rights and legal remedies. We ask for your consent before your inputs go to such a provider. Please do not put sensitive personal information in your prompts.

Email: emails you send to our support address pass through Cloudflare's email routing service and are delivered to a mailbox with Google in the United States, and replies come from that mailbox. Please do not send sensitive information by email. Our site does not send marketing email.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy here, update the "Last Updated" date above, and show you material changes when you next sign in.

12. Contact Us

If you have questions about this Privacy Policy, want to exercise a data protection right, or wish to make a complaint about how we handle your information, contact us at [email protected] and we will respond as quickly as we can. You also have the right to lodge a complaint with your local data protection authority. In Belgium, that is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données).