Privacy Policy

This Policy applies to information we process in connection with the Service — the Tokun API and web console. It does not apply to third-party services you may connect to, or to the independent practices of the upstream model and inference providers or the payment processor that operate under their own privacy policies.

We collect the following categories of information:

• Account information: the email address and identifier associated with your account, obtained through our sign-in process (for example, an email magic link or a supported single sign-on provider).
• Billing information: when you purchase credits, payment details are collected and processed by our payment processor, Stripe. We do not store full payment card numbers; we receive limited billing metadata such as transaction status and amounts.
• Usage and request metadata: we log metadata about your API requests for billing, security, and analytics — for example, timestamps, the model requested, token counts, latency, status, and the API key used.
• Prompt and completion content: the prompts you send and the completions returned are routed to upstream model and inference providers to fulfill your requests. This content passes through our systems in transit and may be processed transiently to operate and meter the Service.
• Technical information: such as IP address, request headers, and similar information generated when you interact with the Service.

We use the information we collect to:

• provide, operate, and maintain the Service, including routing your requests to upstream providers;
• meter usage and bill it against your prepaid credit balance;
• detect, prevent, and investigate fraud, abuse, and security incidents;
• monitor, analyze, and improve the performance, reliability, and features of the Service;
• communicate with you about your account, transactions, and Service changes;
• comply with legal obligations and enforce our terms.

We share information with third parties only as needed to operate the Service:

• Payment processing: with Stripe, to process credit purchases and manage billing.
• Upstream model and inference providers: we transmit your prompts and related request data to the upstream providers that fulfill your requests. Their handling of that data is governed by their own terms and privacy policies.
• Infrastructure subprocessors: with hosting, storage, logging, authentication, and analytics providers that help us run the Service, in each case limited to what they need to perform services for us and subject to obligations consistent with this Policy.
• Legal and safety: when we believe disclosure is required by law, legal process, or to protect the rights, safety, and security of Tokun, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We do not sell your personal information.

We retain account, billing, and usage metadata for as long as your account is active and as needed to provide the Service, meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Request metadata used for billing and analytics may be retained on a rolling basis. We may retain de-identified or aggregated information that does not identify you.

We use technical and organizational measures designed to protect information, including encryption in transit and access controls. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for safeguarding your account credentials and API keys.

You may request access to, correction of, or deletion of the personal information associated with your account by contacting us at support@tokun.sh. We will respond consistent with applicable law. Note that some information may need to be retained for legal, billing, or security reasons, and that deleting your account may end your access to the Service and any remaining credit balance, subject to our terms and applicable law.

The web console uses cookies to authenticate you and maintain your session. Authentication sessions are managed via our identity provider (Ory Kratos), which sets session cookies that are necessary for the console to function. We do not use these cookies for third-party advertising. Disabling necessary cookies may prevent you from signing in or using the console.

The Service is not directed to children. It is intended for users who are at least 18, and in no case for anyone under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us at support@tokun.sh and we will take appropriate steps to delete it.

We may process and store information in countries other than the one in which you reside. By using the Service, you understand that your information may be transferred to and processed in jurisdictions that may have different data-protection rules than your own. We take steps intended to protect information consistent with this Policy wherever it is processed.

The Service may reference or integrate third-party services, such as the payment processor and upstream providers. We are not responsible for the privacy practices of those services. We encourage you to review their privacy policies.

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

If you have questions about this Privacy Policy or our data practices, contact us at support@tokun.sh.