1. What we collect
- Requests and responses, including images.
- Operational metadata of every request: time, key, the model and routing decision that served it, request and response sizes, token counts, latency, status and request ID. The router also keeps its own routing records (the decision and model of a request, without personal data) for up to 7 days.
- IP addresses, to prevent abuse and to limit how many keys one network creates.
- Keys: a hash of each key (the key itself is never stored), its first characters for display, its label if it has one, whether it is active, when it was created and last used, its usage counts, and the IP address that created it (kept up to 30 days).
This website sets one strictly necessary cookie: it lets this browser list and manage the keys it created, and nothing else. It is not used for tracking, and it is removed with the key’s data or when you clear your browser’s cookies. The site loads no analytics, third-party scripts or fonts, and a key you create is never saved in your browser.
2. How we use it
Logged data is stored and processed to operate, secure, debug, analyse and improve the service, including how requests are routed, and to train and evaluate models. No request header turns logging off.
We sanitise text before analysis where feasible, to reduce sensitive or identifying content; this is not a guarantee that all sensitive information is removed. Credentials and secret-shaped strings (API keys, tokens, private keys) are replaced when a request is logged. De-identified data derived from requests, such as sanitised requests and responses and usage statistics, may be published or open-sourced. The status page shows aggregated numbers only.
3. Sensitive data
Do not send sensitive personal information, such as health data, financial or government identifiers, passwords or other credentials, or data about children; nor confidential or regulated data, or data you are not authorised to process.
4. How long we keep it
- IP addresses: up to 30 days (they are deleted after 22 days).
- Requests, responses and metadata: as long as they serve the purposes above, or until you delete them.
- Per-key usage counts shown on the Keys page: 40 days.
5. Revoking a key and deleting your data
Delete key and its data, on the Keys page, or POST /pt/api/keys/self/forget with the key (see the docs), revokes the key at once and deletes everything stored for it: its logged requests and responses, its usage records, its label and its place in your browser’s key list. Only a revoked marker (the key’s hash and its dates) remains, so that the key can never work again. Anything written by a request still running at that moment is removed within two days. From that moment its data is left out of any export.
Revoke key (DELETE /pt/api/keys/self) stops the key and keeps its data; a revoked key can still be deleted with its data from the Keys page of the browser that created it.
Requests sent with the shared workshop key are not linked to a person, so they cannot be deleted per person. A lost key cannot be shown again; create a new one.
6. Changes
This notice may change as the service changes. The current version is always on this page.
7. Contact
Questions about this notice go to the vLLM Semantic Router issues on GitHub.