Privacy policy

Strix (strixgate.dev / api.strixgate.dev) is a model router. This page describes personal data we store, why, how long, and how you can export or delete it. Last updated 27 August 2026.

What we store

• Account: user id, display name, username, hashed Strix API keys (SHA-256), optional email on the waitlist / identity link.
• Memory (opt-in): chat-turn events and derived facts in D1; embeddings of facts in Cloudflare Vectorize. Not used for guardrails.
• BYOK: OpenRouter and optional Venice keys encrypted with AES-GCM (account-bound AAD) under a Worker KEK. We never return plaintext on GET.
• Usage / billing: token counts, models, costs, request ids. Prompt bodies are not stored. AI Gateway log payloads stay off (AIG_COLLECT_LOG_PAYLOAD=false).
• Sessions: optional dashboard chat transcripts until you delete the account or the session.

Legal bases

Contract (routing the API you asked for), legitimate interests (security, aggregated billing, abuse prevention), and consent (durable memory, optional marketing email).

Retention

• Memory, sessions, BYOK ciphertext, and usable API keys are removed when you delete the account or use Forget.
• Hashed usage and billing ledger rows may be kept for accounting and tax. They do not include prompt text or provider secrets.
• The user row is soft-deleted (enabled=0, deleted_at, anonymized email) so old keys cannot authenticate.

Export and delete

Dashboard Settings or Billing: download a JSON export, then delete with two confirmations plus typing DELETE. API (same Strix key as chat):

• POST /v1/account/export — profile, key prefixes, billing status, memory.
• POST /v1/account/delete with { "confirm": "DELETE" } — full wipe. Later auth returns 401.
• POST /v1/memory/export and POST /v1/memory/forget — memory only.

Contact

Privacy requests: privacy@strixgate.dev. More detail lives in the privacy documentation.