Privacy Policy

Summary

We collect the minimum needed to run TokenBaazar: your email, wallet balance, API-key metadata, and per-request usage counters. We do not store your prompts or model responses.

1. What we collect

• Account: email, hashed password (via Supabase Auth), or Google OAuth identifier.
• Wallet: topup amount, provider transaction ID (Razorpay / Stripe), and running balance.
• API keys: a salted+peppered hash and a short prefix for display. We never store the raw key.
• Usage logs: timestamp, model ID, token counts, cost, and HTTP status. No prompts, no completions.
• Region: approximate country from IP, used only to localize currency and payment options.

2. What we do NOT collect

• Prompt content or model output — these stream through the proxy and are discarded after the response completes.
• Card numbers — handled by Razorpay / Stripe directly. We only see the transaction ID.

3. How we use data

• Operate the API and bill your wallet accurately.
• Detect abuse and fraud.
• Send transactional email (topup receipt, low balance alert).
• Legal compliance under Indian and applicable foreign law.

4. Sharing

We share request payloads with upstream model providers (OpenAI, Google, Anthropic) so they can generate the response. Their privacy policies apply to that leg. We do not sell your data.

Subprocessors: Supabase (database + auth), Cloudflare (hosting + CDN), Razorpay (India payments), Stripe (international payments), Resend (transactional email).

5. Retention

• Usage logs: 90 days, then aggregated.
• Payment records: 7 years (tax law).
• Account data: until you delete your account.

6. Your rights

You can access, export, or delete your account data any time from the dashboard or by emailing privacy@tokenbaazar.in. GDPR / DPDP Act rights are honored.

7. Security

Data is encrypted in transit (TLS 1.3) and at rest. API keys are hashed with a server-side pepper. Row-level security scopes every database row to its owner.

8. Cookies

We use a single session cookie for authentication. No third-party ad trackers.

9. Children

TokenBaazar is not for anyone under 18.

10. Contact

See our Terms or contact privacy@tokenbaazar.in.