Privacy Policy

This policy explains what information OxyRouter collects when you use the website, the dashboard, and the API, why we collect it, and the choices you have. By using OxyRouter, you agree to the practices described here.

We collect the following categories of information:

• Account data. Your email address, hashed password, email-verification status, linked OAuth provider identifiers, and multi-factor authentication settings.
• Usage data. The model and provider used, token counts, request identifiers, latency and status, and the calculated cost of each request. Prompts are not stored in normal usage records. For non-streaming requests, the response may be retained temporarily to support idempotent retries.
• Billing data. Wallet balance, ledger and referral entries, and payment transaction references. Full card details are handled by our payment processor and are not stored by OxyRouter.
• Security data. Session identifiers, IP address, browser user agent, approximate device information, and security event history used to protect your account and detect abuse.
• Bring-your-own-key data. If you save a personal provider credential, the API token and optional base URL are encrypted at rest. The token is never returned to the browser after saving.

We use the information above to:

• Create and secure your account, authenticate sessions, and verify your email.
• Route inference requests, meter usage, and calculate charges.
• Operate the wallet, referrals, and billing features.
• Detect fraud, abuse, and security incidents, and enforce rate limits.
• Provide support, troubleshoot problems, and improve the service.
• Comply with legal obligations and enforce our Terms and Conditions.

OxyRouter uses a small number of first-party cookies and browser storage entries that are required to operate the service:

• An HTTP-only session cookie that keeps you signed in and secures your account.
• Your theme preference, stored locally in your browser.
• Your cookie-consent choice, stored locally in your browser.

We do not use advertising cookies or cross-site tracking cookies. Because the cookies we use are essential to the service, clearing them may sign you out or reset your preferences.

We share information only as needed to run the service. Inference requests are sent to the model providers you select or that are available on the platform, and those providers process the request under their own terms and privacy policies. We also use service providers for payment processing, email delivery, and hosting. We may disclose information if required by law, to protect the service or its users, or as part of a merger or acquisition. We do not sell your personal information.

We keep account information while your account is active and for as long as needed to meet legal, tax, and accounting obligations. Usage and billing records are retained for the periods required to operate the service and comply with applicable law. Security logs are kept for a limited period and then deleted or aggregated. When you delete your account, we remove or anonymize personal information that we are not required to keep.

We protect information with measures such as encrypted transport, password hashing, encryption of saved provider credentials, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Tell us promptly if you believe your account or a credential has been compromised.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can update much of your account data from the dashboard. To make a privacy request, contact us at privacy@oxyrouter.in. We may need to verify your identity before acting on a request.

OxyRouter is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to remove it.

OxyRouter and its service providers may process information in countries other than your own. Where required, we use appropriate safeguards for those transfers.

We may update this policy as the service or the law changes. We will revise the date at the top of this page and, for material changes, provide a prominent notice or contact you directly where appropriate.

Questions about this policy or your information? Email privacy@oxyrouter.in.