FifeRouter

Last updated 30 August 2026

Privacy Policy

The short version: we log what we routed and what it cost. We do not log what you asked or what the model answered. That is not a promise about our intentions — it is a property of the decision record, which is a closed set of typed fields with nowhere for content to go.

Who we are

FifeRouter ("we", "us") operates the API at api.fiferouter.com and this website. For questions about this policy or about data we hold, write to privacy@fiferouter.com.

What we collect

Account information

Your email address and a password hash. Passwords are hashed with Argon2id and are never stored in a form we can reverse — if you lose it we can only reset it, not tell you what it was. We also store the time the account was created and its status.

API keys

When you create an API key we store a hash of it, a short masked prefix so you can tell your keys apart, the name you gave it, and when it was created, last used and revoked. We do not store the key itself. It is shown to you once, at creation, and cannot be retrieved afterwards by us or by anyone else.

Routing decisions

Every request produces one record per model attempt. That record contains: the concept the request was classified as, the confidence and which rung of the classifier produced it, which models were considered, which were eliminated and on what ground, which was chosen, token counts, computed cost, latency, and the outcome.

It does not contain your prompt, the model's response, or any excerpt of either. This is a structural guarantee rather than a policy one: the decision record is a fixed set of typed fields, and adding one that could carry content is a schema change that has to be argued for in public in our product graph.

Payments

Card payments are processed by Stripe. Card numbers never reach our servers — checkout happens on Stripe's own pages. We receive and store the amount, the currency, the Stripe session and event identifiers, and the resulting ledger entry. Stripe's handling of your payment information is governed by Stripe's privacy policy.

Sessions

Signing in sets one cookie holding a session token. The cookie is HttpOnly, Secure and SameSite=Lax, and the server stores only a hash of the token. It exists to keep you signed in and for nothing else.

Page counts

We count page views so we know which pages are read. What is stored is a running total against three things: the date, which page, and which site linked here. That is the whole record — there is no row for your visit, and the table has no column for a person, so a single visit cannot be picked out of it even by us.

No cookie is set or read for this, no identifier is generated, and nothing is kept in your browser. A referring link is reduced to its host name before storage, because the rest of someone else's URL is not ours to keep. Your IP address is used to rate-limit the counter, in memory, and is never written down.

The mailing list

If you subscribe to our updates we store your email address, when you confirmed it, and where you subscribed from. Nothing is sent to an address until someone clicks a link in a message delivered to that address — a form submission on its own is not treated as consent, because anyone can type anyone's address into a form.

The confirmation timestamp is our record that you asked. We deliberately do not store the IP address of whoever filled in the form: clicking a link sent to an address is better evidence than that, and it lets the statement above about IP addresses stay true.

Every message carries a one-click unsubscribe. When you use it we keep the row and mark it unsubscribed rather than deleting it. That is deliberate — a deleted address can be re-added by a later import with nobody noticing, and a suppressed one cannot. If you would rather be erased entirely, write to privacy@fiferouter.com and we will do that instead.

What we do not collect

No advertising identifiers, no third-party trackers, no analytics cookies, no cross-site profiles, and no cookies beyond the session cookie described above. This site makes no requests to third-party domains — you can verify that in your browser's network tab, and our Content-Security-Policy enforces it.

Why we hold it, and on what basis

DataPurposeLawful basis (UK/EU GDPR)
Email, password hashAuthenticate youPerformance of a contract
API key hashesAuthenticate requests, attribute usagePerformance of a contract
Routing decisionsBill you accurately, show you your usage, debug routingPerformance of a contract; legitimate interests
Ledger and payment recordsTake payment, keep accountsPerformance of a contract; legal obligation
Session tokensKeep you signed inStrictly necessary
Page countsKnow which pages are readLegitimate interests — aggregate only, no personal data stored
Mailing listSend updates you asked forConsent, given by confirming a link sent to that address

How long we keep it

Who else sees it

We share data with three kinds of recipient, and no others:

We do not sell personal data, and we do not share it for advertising. Mailing-list messages are delivered by our email provider, which receives the address in order to deliver them.

The complete sub-processor list, with what each one receives and where it is located, is on the trust page.

Where it is processed

Our servers are in Germany. Model providers may process requests elsewhere, which is precisely why residency is a routing constraint rather than a preference: a request marked critical will not be sent to a vendor-hosted model, and if no in-infrastructure model is available it is refused rather than quietly downgraded.

Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to our processing of your data, and to receive a copy in a portable format. Write to privacy@fiferouter.com and we will respond within 30 days. If you are in the UK or EU and are unhappy with our response, you may complain to your national data protection authority.

Security

Traffic is TLS-encrypted. Passwords use Argon2id; API keys and session tokens are stored as hashes. The router's own port is not reachable from the internet — every request arrives through the edge, having passed TLS, header stripping and rate limiting. We cannot recover any credential you lose, which is the point of storing them the way we do.

Children

This service is not directed at children under 16, and we do not knowingly collect their data.

Changes

If we change this policy we will update the date at the top and, for material changes, email account holders. Past versions are in the public repository — this page is version-controlled like everything else here.