Privacy Policy

[Company legal name] ("we") runs Sluice. This policy explains what we collect, why, and your choices. Contact: [privacy email].

What we store

• Account: your email address, a salted scrypt hash of your password (never the password itself), and whether you confirmed your email.
• Sessions: a hash of your sign-in cookie, its IP address, browser user agent and expiry, to keep you signed in and protect your account.
• API keys: a hash of each key and its first characters, label, spend limit and usage totals. We can't recover a lost key.
• Usage records: for each API request: time, model, provider, token counts, cost, latency and status. We do not store your prompts or the model's responses, except: answers kept in the repeat cache for its time limit (default 1 hour) when you use caching, and batch requests and results, kept so you can fetch them until you delete them with your account.
• Payments: amount, date and Stripe reference. Card details are handled by Stripe and never reach us.

Who processes your data

Your prompts are sent to the AI provider that serves each request (OpenAI, Anthropic, Groq or Together AI), under their terms and data policies. We also use Stripe (payments), [email provider, e.g. Resend] (transactional email), and [hosting and database providers]. We don't sell personal data and don't use advertising trackers; the site sets only the cookie needed to keep you signed in.

Retention and deletion

We keep your data while your account is open. When you delete your account in Settings, we delete your account, sessions, API keys and usage records immediately. Payment records are kept, without the link to your account, for as long as tax and accounting law requires.

Your rights

Depending on where you live you may have rights to access, correct, export or delete your data, and to complain to a supervisory authority. Contact [privacy email]; we will reply within 30 days.

Security

Connections are encrypted (HTTPS), passwords and keys are stored only as hashes, and access to production systems is restricted. If we learn of a breach affecting you, we will notify you as the law requires.