TokenZero Privacy Policy
Effective: 2026-10-26
This policy explains what the TokenZero service (the "Service"), operated by TokenZero ("we"), handles when you send LLM requests through the TokenZero gateway, use the dashboard, or run a hosted audit. The open-source TokenZero tools (CLI, MCP server and GitHub Action) run on your own machines; see section 7.
1. Summary
- Bring your own key. You call your LLM provider with your own API key, through us. We forward it to the provider for that request and do not store it.
- Prompts and responses pass through in memory. We do not log them. The one exception is the response cache (section 4): a cached response is stored for its time to live, default 1 hour, and only if caching applies to that request.
- We keep metering metadata: token counts, model names, costs, timing and savings per request. Not prompt or response text.
- No cookies, no advertising trackers, no selling of data.
2. What we process for each gateway request
| Data | What we do with it | Stored? |
|---|---|---|
| Your provider API key | Forwarded to the provider over TLS for this request only. For anonymous workspaces we derive a one-way identifier from it (HMAC with a server secret) so repeat requests land in the same workspace. | No. Only the derived identifier, which cannot be turned back into the key. |
| Your TokenZero workspace key | Authenticates you. | Only a hash. |
| Prompt and request body | Read in memory to count tokens, apply caching hints, and choose savings engines; then forwarded to the provider. | No, except as part of a cache key (a hash) and, for caching, see section 4. |
| Provider response | Streamed back to you; scanned in memory for the usage numbers the provider reports. | No, except cached responses (section 4). |
| Request metadata | Time, workspace, provider, endpoint, requested and served model, HTTP status, streaming flag, token counts (input, output, cached, cache-write), list-price baseline cost, actual cost, savings, which engines acted, latency, and a signed receipt. | Yes, in the ledger (section 5). |
| Your IP address | Used in memory to rate-limit abuse. | No. Not written to the ledger or our logs. |
3. Upstream providers
You choose the provider (for example OpenAI, Anthropic or Google). Your request goes to that provider under your account and your agreement with them; their privacy terms govern what they do with it. We only forward to known LLM provider endpoints.
4. Response cache
Caching is designed to save you money by not paying for the same model call twice.
- When it applies. Exact caching applies to deterministic requests (for example temperature 0) or when you opt in. Similarity ("semantic") caching applies only if you turn it on. You can turn caching off for a workspace or a single request.
- What is stored. The provider's response body and headers, the model, token counts, and a hash of the request. The cache key and similarity fingerprint are derived from the request; the request text itself is not stored.
- How long. Each entry has a time to live: 1 hour by default, configurable by you up to 30 days. Expired entries are no longer served and are deleted within about one minute of expiry. Entries can also be evicted earlier when the cache is full.
- Who can see it. A cached response is only ever served back to the same workspace that created it.
5. Ledger and retention
The ledger is the per-request metadata in section 2. It powers your dashboard, usage metering, savings reports and receipts. It contains no prompt or response text.
- Retention: ledger metadata is kept for as long as the workspace exists. To delete a workspace and its ledger, email support@tokenzero.sh from a message that includes the workspace id and proves control of its key (for example by rotating it); we delete within 30 days.
- Aggregate statistics for a workspace are private unless you switch on public statistics for it. Public statistics show totals (requests, tokens, savings), never individual requests.
- Accuracy. To keep the gateway fast, ledger rows are written in small batches a few tens of milliseconds after each request. If a server stops abruptly, rows from that short window can be lost. Losses can only under-count your usage and savings, never over-count them.
6. Dashboard
The dashboard keeps your workspace key in your browser's sessionStorage for the current tab, so it is cleared when you close the tab. We set no cookies. Pages are served with Referrer-Policy: no-referrer.
7. Audits
- Local tools. The CLI, MCP server and GitHub Action analyse code on your machine or CI runner. Your code is not uploaded to us.
- Hosted audits. If you ask the Service to audit a public GitHub repository or pull request, we fetch the files from GitHub and store the resulting report (findings, file paths, line numbers and short excerpts) so it can be shared by link. Retention: reports of public repositories are kept and may be listed on the public audits directory, since they only describe public code; a repository owner can ask support@tokenzero.sh to remove its report.
8. Operational logs
Server error logs contain the time, the HTTP method, the request path (with any workspace key removed) and the error. They do not contain request bodies, responses or API keys.
9. Subprocessors
- OVHcloud (servers in North America) runs the Service and stores the data above; Cloudflare (United States) proxies HTTPS traffic to it and sees request metadata in transit: runs the Service and stores the data above.
- GitHub: source of repositories you ask us to audit.
- The LLM provider you choose: receives your requests under your own account.
10. Security
Traffic is encrypted in transit. Receipts are signed with Ed25519 and can be verified against our published key at /.well-known/tokenzero.json. Workspace keys are stored hashed and can be rotated at any time from the dashboard or CLI.
11. Your choices and rights
You can rotate your workspace key, turn off caching, keep statistics private, and ask us to delete a workspace and its ledger and cache data by writing to support@tokenzero.sh. Depending on where you live you may have rights to access, correct, delete or port your personal data, and to complain to a supervisory authority. We will answer within 30 days.
12. Children
The Service is for developers and businesses and is not directed to children under 16.
13. Changes
We will post changes here with a new effective date, and give at least 14 days' notice of material changes on the website.
14. Contact
support@tokenzero.sh (support) · legal@tokenzero.sh (legal notices) · https://tokenzero.sh
--- *Source of truth (for reviewers, remove on publication):* key handling src/gateway.ts, src/workspaces.ts (anonymousId); cache TTL and sweeper src/engines/cache.ts; ledger columns src/db.ts; write-behind batching src/db.ts (queueWrite); dashboard storage src/web.ts; hosted audits src/audit.ts; error logging src/server.ts.