Last updated 30 August 2026
Privacy Policy
The short version: we log what we routed and what it cost. We do not log what you asked or what the model answered. That is not a promise about our intentions — it is a property of the decision record, which is a closed set of typed fields with nowhere for content to go.
Who we are
FifeRouter ("we", "us") operates the API at
api.fiferouter.com and this website. For
questions about this policy or about data we hold, write to
privacy@fiferouter.com.
What we collect
Account information
Your email address and a password hash. Passwords are hashed with Argon2id and are never stored in a form we can reverse — if you lose it we can only reset it, not tell you what it was. We also store the time the account was created and its status.
API keys
When you create an API key we store a hash of it, a short masked prefix so you can tell your keys apart, the name you gave it, and when it was created, last used and revoked. We do not store the key itself. It is shown to you once, at creation, and cannot be retrieved afterwards by us or by anyone else.
Routing decisions
Every request produces one record per model attempt. That record contains: the concept the request was classified as, the confidence and which rung of the classifier produced it, which models were considered, which were eliminated and on what ground, which was chosen, token counts, computed cost, latency, and the outcome.
It does not contain your prompt, the model's response, or any excerpt of either. This is a structural guarantee rather than a policy one: the decision record is a fixed set of typed fields, and adding one that could carry content is a schema change that has to be argued for in public in our product graph.
Payments
Card payments are processed by Stripe. Card numbers never reach our servers — checkout happens on Stripe's own pages. We receive and store the amount, the currency, the Stripe session and event identifiers, and the resulting ledger entry. Stripe's handling of your payment information is governed by Stripe's privacy policy.
Sessions
Signing in sets one cookie holding a session token. The cookie is
HttpOnly, Secure
and SameSite=Lax, and the server stores
only a hash of the token. It exists to keep you signed in and for
nothing else.
Page counts
We count page views so we know which pages are read. What is stored is a running total against three things: the date, which page, and which site linked here. That is the whole record — there is no row for your visit, and the table has no column for a person, so a single visit cannot be picked out of it even by us.
No cookie is set or read for this, no identifier is generated, and nothing is kept in your browser. A referring link is reduced to its host name before storage, because the rest of someone else's URL is not ours to keep. Your IP address is used to rate-limit the counter, in memory, and is never written down.
The mailing list
If you subscribe to our updates we store your email address, when you confirmed it, and where you subscribed from. Nothing is sent to an address until someone clicks a link in a message delivered to that address — a form submission on its own is not treated as consent, because anyone can type anyone's address into a form.
The confirmation timestamp is our record that you asked. We deliberately do not store the IP address of whoever filled in the form: clicking a link sent to an address is better evidence than that, and it lets the statement above about IP addresses stay true.
Every message carries a one-click unsubscribe. When you use it we keep the row and mark it unsubscribed rather than deleting it. That is deliberate — a deleted address can be re-added by a later import with nobody noticing, and a suppressed one cannot. If you would rather be erased entirely, write to privacy@fiferouter.com and we will do that instead.
What we do not collect
No advertising identifiers, no third-party trackers, no analytics cookies, no cross-site profiles, and no cookies beyond the session cookie described above. This site makes no requests to third-party domains — you can verify that in your browser's network tab, and our Content-Security-Policy enforces it.
Why we hold it, and on what basis
| Data | Purpose | Lawful basis (UK/EU GDPR) |
|---|---|---|
| Email, password hash | Authenticate you | Performance of a contract |
| API key hashes | Authenticate requests, attribute usage | Performance of a contract |
| Routing decisions | Bill you accurately, show you your usage, debug routing | Performance of a contract; legitimate interests |
| Ledger and payment records | Take payment, keep accounts | Performance of a contract; legal obligation |
| Session tokens | Keep you signed in | Strictly necessary |
| Page counts | Know which pages are read | Legitimate interests — aggregate only, no personal data stored |
| Mailing list | Send updates you asked for | Consent, given by confirming a link sent to that address |
How long we keep it
- Account and key records — while your account exists, and for 30 days after you delete it.
- Decision records — 13 months, so a year-on-year comparison is possible, then deleted.
- Ledger and payment records — 7 years, because they are accounting records and we are required to keep them.
- Sessions — until they expire or you sign out.
- Mailing list — while you are subscribed. After you unsubscribe we keep the address on a suppression list indefinitely, so it cannot be re-subscribed by mistake, unless you ask us to erase it.
- Page counts — 26 months. They are aggregates with no personal data in them, so this is a housekeeping limit rather than a privacy one.
Who else sees it
We share data with three kinds of recipient, and no others:
- Model providers. To answer your request we send your prompt to the provider of the model the router selected. What they do with it is governed by their terms. Which providers can receive which traffic is visible on our models page, and requests you mark as critical are pinned to in-infrastructure models by a hard filter that no preference or fallback can override.
- Stripe, for payment processing.
- Our hosting provider, which operates the server this runs on.
We do not sell personal data, and we do not share it for advertising. Mailing-list messages are delivered by our email provider, which receives the address in order to deliver them.
The complete sub-processor list, with what each one receives and where it is located, is on the trust page.
Where it is processed
Our servers are in Germany. Model providers may process requests elsewhere, which is precisely why residency is a routing constraint rather than a preference: a request marked critical will not be sent to a vendor-hosted model, and if no in-infrastructure model is available it is refused rather than quietly downgraded.
Your rights
Depending on where you live you may have the right to access, correct, delete, restrict or object to our processing of your data, and to receive a copy in a portable format. Write to privacy@fiferouter.com and we will respond within 30 days. If you are in the UK or EU and are unhappy with our response, you may complain to your national data protection authority.
Security
Traffic is TLS-encrypted. Passwords use Argon2id; API keys and session tokens are stored as hashes. The router's own port is not reachable from the internet — every request arrives through the edge, having passed TLS, header stripping and rate limiting. We cannot recover any credential you lose, which is the point of storing them the way we do.
Children
This service is not directed at children under 16, and we do not knowingly collect their data.
Changes
If we change this policy we will update the date at the top and, for material changes, email account holders. Past versions are in the public repository — this page is version-controlled like everything else here.