Guides

Privacy and zero data retention

What we never store, the metadata we keep and for how long, privacy modes and model privacy tiers.

Zero data retention, guaranteed on Private models

Tokentide never stores what you send or what models return, on any endpoint, lane or payment rail. On Private models (and TEE and E2EE models), Venice retains nothing either, so the guarantee holds end to end. Anonymized models are opt-in and clearly labeled, because their third-party provider sees your content under its own policy (without your identity).

What we promise

Promise	Scope	How it is enforced
We never store prompts, inputs, files, images, audio or outputs	All endpoints, all lanes, all payment rails	Bodies stream through memory only. No body ever reaches logs, telemetry, error trackers, queues, databases or disk. The database schema has no column that could hold content
Zero data retention end to end on Private models	Venice models with privacy `private`, plus TEE and E2EE models	Venice retains nothing for Private models; Tokentide retains nothing. New API keys default to privacy mode `private`
Anonymized models are opt-in and labeled	Venice models with privacy `anonymized` (for example Claude, GPT and Gemini models)	Require a key with privacy mode `all`. The provider sees, and may retain, content under its own policy, without your identity
Your identity never leaves Tokentide	Every upstream call	Venice receives our key and a pseudonymous per-account hash. Never your IP address, cookies, user agent, email or account id
End-to-end encryption when you need cryptographic guarantees	`e2ee-*` models on `/v1/chat/completions`	You encrypt to a hardware-attested key fetched directly from Venice; Tokentide relays ciphertext. See E2EE

We test this continuously: daily synthetic requests carrying unique random canary strings go through production, then every place data could land (logs, traces, error tracking, database, caches, storage, queues) is searched for them. Any hit is handled as a top-severity incident.

Privacy modes (per API key)

Privacy mode	May call	Venice equivalent
`private` (default)	Private, TEE and E2EE models only	`PRIVATE_ONLY`
`private_text`	Text, embedding and decision models must be Private, TEE or E2EE; image, video and audio models may be anonymized	`PRIVATE_TEXT`
`all`	Every model, including anonymized ones	`ALL`

A model your key may not call answers 403 model_not_allowed, and GET /v1/models lists only the models your key may call.

Every model response carries X-Tokentide-Model-Privacy:

Tier	Meaning
`private`	Venice runs the model without retaining prompts or outputs (contractual zero retention)
`tee`	Runs inside a hardware trusted execution environment (TEE) whose attestation Venice publishes
`e2ee`	End-to-end encrypted to an attested enclave key (when you send the E2EE headers)
`anonymized`	Runs at a third-party provider, without your identity; the provider’s own retention policy applies

The Decisions endpoint (/v1/decisions, /v1/systemone) runs on an anonymized model, so it needs a key with privacy mode all.

What we add to upstream requests

To protect the shared upstream account without revealing who you are, Tokentide adds pseudonymous fields to requests that accept them (never to E2EE requests, and never to routes with strict schemas that reject them):

anon_user_id and user: the same opaque per-account hash (tt_…). It lets Venice attribute abuse and budget errors per customer without knowing the customer, so one misbehaving client cannot lock out everyone else.
prompt_cache_key: namespaced per account, so prompt caches are never shared across customers (no cross-tenant cache-timing side channel).

Everything else in your body is forwarded byte for byte.

What we store (metadata only)

Data	Why	Retention
Account: email, sign-in factors, role	Sign-in, security, legal	Life of the account + 30 days
Billing: deposits, refunds, invoices, country, VAT data	Accounting and tax law	6 years
Per-request metadata: ids, timestamps, endpoint, model, lane, multiplier, epoch, token and unit counts, list cost, charge, status, error class, latency, byte sizes, upstream id	Billing disputes, troubleshooting, market learning	90 days in full, then hourly aggregates (6 years) and deletion of the detail
IP address	Abuse prevention, rate limiting	Never stored raw. Only a hash of the /24 (IPv4) or /48 (IPv6) network with a salt that rotates daily, kept 30 days
Security audit log	Accountability	2 years

All stored data lives in the United States (AWS US East): the database (Neon Postgres), the API’s fast state store (Upstash Redis) and the API itself (Vercel). The fast state store holds only short-lived identifiers, hashed network prefixes, counters and balance reservations. The Privacy Policy has the complete list, legal bases, your rights and how transfers from the EU are safeguarded.

Upstream error messages can echo your input, so we store them only when they match a known template; otherwise we keep a code and a hash.

Idempotency without retention: Idempotency-Key detects duplicates for 24 hours, but results are never replayed, because we do not keep them.

Query strings are not private

Our hosting platform logs request paths, including query strings. Never put secrets or personal data in a URL; send them in headers or the body.

Who sees your requests

Party	Sees
Vercel (hosting)	TLS terminates at Vercel’s edge. Request metadata (method, path including query string, status, host, IP, user agent) is logged by the platform; bodies pass through function memory and are not logged
Venice.ai	Request content (to run inference), Tokentide’s key, pseudonymous ids, our egress IP and timing. Private models: zero retention
Upstream providers (anonymized models only, opt-in)	Content without your identity
Stripe, Neon, Upstash, our email provider	Payment and account metadata. Never inference content

The full list is on the sub-processors page.

Troubleshooting without content

Every response has an X-Request-Id. In the dashboard, the Request Inspector shows that request’s metadata: upstream status and ids, retries, timings, token counts, error class (and the error message when it matches a known template), the epoch state, lane and multiplier, plus guided diagnostics (for example “context length exceeded”, “Low Tide closed”, “price above your max multiplier”). GET /v1/account/usage returns the same metadata as JSON or CSV.

X-Tokentide-Debug: 1 adds diagnostic headers to a response. Nothing extra is stored.

Debug Capture (planned)

For the rare case where metadata is not enough, you will be able to enable capture on one key for a limited window (at most 24 hours and 200 requests). Captured requests and responses are sealed to your X25519 public key, so Tokentide cannot read them; you decrypt them locally and decide whether to share them with support. Off by default, with a banner while active, and excluded from the zero-retention guarantee by your explicit opt-in.

Content policy without reading content

Models whose primary purpose is adult content are not offered.
Image endpoints always run with safe_mode on (and moderation: "auto" on /v1/images/generations).
Our Acceptable Use Policy incorporates Venice’s terms and upstream providers’ policies.
Because we never read content, enforcement uses signals: upstream content-policy rejections, payment risk signals and abuse reports to abuse@tokentide.app. Responses are graduated: warning, rate cap, suspension, ban.

Tokentide is based in Spain. You can export your data (account, key metadata, spending caps, billing settings with the saved card's details and your auto top-up consent, automatic top-ups, alert e-mails, usage metadata, ledger) as JSON or CSV and delete your account from the dashboard; ledger records required by tax law are anonymized rather than deleted. Write to privacy@tokentide.app for anything else; we answer within 30 days. A DPA is available for business customers, and the list of sub-processors is public.