Privacy Policy

How Free Model works

Free Model lets you use AI models through your own provider accounts (OpenRouter, Groq or Cerebras). You create the account and the API key at the provider yourself. Free Model never creates provider accounts or keys for you and doesn't share keys between people.

What we store

• Account data: your name, email address, password hash or sign-in provider, profile details, and session records.
• Sign-in and security metadata: for example IP address, browser user agent and timestamps, used to run sessions and to detect abuse.
• Provider keys: encrypted on our server with a private encryption secret before they are saved. They are never shown again after you paste them.
• Free Model API keys: stored only as a hash. The full key is shown once, when you create it.
• Request records: for each chat or API request we record the owner, provider, model, status, time, reported token counts, response times, the Free Model API key record ID and any error code. These records don't contain your prompts or the model's replies.
• Attribution cookies: when you arrive from a link with UTM parameters or from another site, we may keep those values for 30 days and attach them to your account when you sign up.

You can view your own usage in the site. Administrators can view site-wide and per-account usage metadata. Statistics exclude conversation text and keys.

What we don't store

• Conversation text. A chat exists only in the open browser page. It is gone when you close the page, start a new chat or sign out. Prompts and replies pass through our server on the way to and from the provider, but they aren't written to request records.
• Provider keys or Free Model API keys in your browser's storage.

Who receives your data

• The provider you choose. Each request, including its text, is relayed with your key to the provider and model you selected (or to one picked by Auto). The provider handles it under its own terms and privacy policy, which are separate from ours.
• Our infrastructure providers, which host and back up the service.
• Analytics or support tools, only if the site operator has turned them on.
• Authorities, where the law requires it.

We don't sell personal information.

How long we keep it

• Request records older than about 30 days are removed as new gateway requests finish. Removal is batched, so records can stay longer, especially for inactive accounts. We don't promise deletion exactly at 30 days.
• Disconnecting a provider deletes its stored key. Revoking a Free Model API key stops all future API access with it.
• Account data stays while your account exists.
• Infrastructure backups follow their own retention schedules. We don't offer zero-retention guarantees.

Your choices

You can disconnect providers and revoke API keys at any time from Connections and API. Account export and self-service account deletion aren't available in the product yet. To ask about your data, use the contact details published on this site.

Security

Keys are encrypted or hashed as described above, and connections use HTTPS. No system is perfectly secure, and we can't guarantee that unauthorized access will never happen.

Changes

We'll update this page when the product changes, and the date above will change with it.