Privacy Policy

Who we are

InferHood operates a unified inference gateway that routes API requests to third-party AI model providers, meters usage, and bills for it. References to “we” and “us” mean InferHood; “you” means the account holder using the service.

What we collect

Account information. Authentication is handled by our identity provider, Privy. Depending on how you sign in, we receive a user identifier and any of an email address, wallet address, or linked social account identifier. We do not receive or store your password, private keys, or wallet seed phrase.

Usage metadata. For every API request we record a request identifier, the model and upstream provider used, input and output token counts, computed cost, latency, HTTP status, and the API key or agent that made the call. This is what powers your usage, logs, and billing pages, and it is how charges are calculated.

Billing records. Credit balances, top-ups, and per-request debits are stored as a ledger against your workspace.

Prompt and completion content. By default we do not store the content of your prompts or model responses - only the metadata above. Content is held in memory only for as long as it takes to proxy the request. Operators may enable prompt logging for debugging via a server configuration flag; if that is enabled on the deployment you are using, prompt content may be written to server logs.

How we use it

• To route your requests to the appropriate model provider and return the response.
• To meter usage, calculate cost, and debit your credit balance.
• To show you usage analytics, request logs, and billing history.
• To enforce rate limits, API key scopes, and agent budgets.
• To detect abuse and protect the service and other customers.
• To provide support when you ask for it.

We do not sell your data, and we do not use your prompts or completions to train models.

Third parties we share data with

Running the service requires sending certain data to processors acting on our behalf:

• Model providers. Your prompt is forwarded to the provider that serves the model you selected. That provider’s own privacy terms govern what it does with the request. The model you choose determines which provider receives your data.
• Privy - authentication and wallet infrastructure.
• Supabase - the managed PostgreSQL database holding accounts, keys, usage records, and billing ledgers.
• Hosting and CDN providers - serving the application and API.

On-chain data

If you use wallet-based sign-in or on-chain payments, your wallet address and any transactions you authorize are recorded on a public blockchain. Blockchain records are permanent and outside our control - we cannot edit or delete them. Do not use a wallet for payment if you need that activity to remain private.

How long we keep it

Usage records and billing ledger entries are retained while your account is open, and afterwards for as long as needed to meet accounting and legal obligations. Account information is deleted on request, subject to those same obligations. API keys are stored only as an irreversible hash and are destroyed when revoked.

Security

API keys are never stored in plaintext - we keep only a SHA-256 hash and a short display prefix, which is why a key can be shown to you exactly once. Traffic is encrypted in transit. Access to production data is limited to the systems that need it. No system is perfectly secure, so please use scoped keys, rotate them periodically, and revoke any key you believe has been exposed.

Your choices

• Request a copy of the account and usage data we hold about you.
• Request correction or deletion of your account data.
• Revoke any API key at any time from the dashboard.
• Choose which model - and therefore which upstream provider - handles each request.

Children

The service is not directed to anyone under 16, and we do not knowingly collect their data.

Changes

We will update this page when our practices change and revise the date above. Material changes will be communicated to account holders.

Contact

Questions about this policy, or a data request, can be raised through the channels listed on our home page. See also our Terms of Service.