Privacy and data
Prompts and completions are not stored
Cloakray doesn't store your prompts or completions and doesn't train on them. Requests are passed to the model to be answered, and what comes back is passed to you; neither is written to our storage.
What we keep is what your bill needs: the model, endpoint, status, token counts, timing and cost of each request, plus the key and project that made it. That is what you see in your logs.
The model that serves a request handles it under its own data policy.
Features that keep content
A few features have to keep content to work. Each is tied to your project and can't be read with another project's key.
| Feature | What's kept | For how long |
|---|---|---|
Stored Responses (store is on by default) | The response, so previous_response_id and retrieval work | 30 days. Set store: false to opt out. |
| Video jobs | The finished video, so you can download it | Until it expires; download it promptly. |
Retention
| Data | Kept for |
|---|---|
| Request logs (metadata only) | 90 days |
| Analytics totals | Longer, as hourly aggregates without request detail |
| Billing records | As long as accounting requires |
Keeping your data safe
- Keep API keys on your servers. Never put one in a browser bundle, a mobile app, a URL or a public repository.
- Use one key per app and environment, and roll a key the moment it may have leaked.
- Remove people from your team when they leave; their keys are deleted with them.
- Don't send personal data a task doesn't need. Redact or pseudonymise it before the request.
Legal
The terms and privacy policy are the binding versions of everything above.