Privacy, plainly.

Who we are

Oathbreaker AI is operated by Formacha LLC, a United States company. Formacha LLC is responsible for the personal information described in this policy. Contact us at support@oathbreaker.ai for privacy questions or requests.

This policy covers the Oathbreaker website, account console, and API. Other services you choose to connect, including an agent application on your own device, have their own data practices.

Your account

Clerk handles account registration, email verification, Google sign-in, and sessions. Depending on how you sign in, it processes your email address, profile information, authentication details, and device and connection information. Our console displays your name and email and connects your account identifier to your API keys, balance, purchases, and usage.

We use this information to provide access, keep accounts separate, prevent misuse, and help with support requests. We do not receive your Google password. If you email us, we also receive your address and the information you include in your message.

API requests and responses

Your prompts, conversation content, and request settings pass through our hosting infrastructure to Refuseless for model inference. Refuseless may route requests to downstream model providers under its published data practices. Generated responses return through the service to your application or console.

The API does not save prompt or response text in our account database. It records a request fingerprint, model identifier, token counts, timestamps, request status, and charges to operate the service and prevent duplicate requests. The console keeps the current playground conversation in memory rather than saving it in browser storage.

Hosting and inference providers also process data to operate and secure their services. Their handling of customer data and operational records is governed by their terms and our agreements with them; this policy does not establish zero retention or a universal restriction on provider model-training use. Do not submit passwords, full payment-card details, protected health information, or other information you are not authorized to share.

Keys, payments, and service records

We store the names you give API keys, identifying prefixes, one-way key fingerprints, creation dates, and revocation status. The complete API secret is shown when created and is not stored in our account database. We also keep credit balances, reservations, usage charges, and records of billing adjustments or account reviews.

Stripe hosts checkout and processes payment details, billing information, and transaction information. Our application receives payment references, amounts, currency, status, and account information needed to credit purchases and handle refunds or disputes. Full payment-card details are entered with Stripe, not collected by our application.

Browser storage and security data

If you take the entrance oath, your browser saves a simple preference so the introduction does not repeat on later visits. This preference stays on your device and does not identify you or track your activity.

Authentication and security providers use cookies or similar browser mechanisms to maintain sessions and protect sign-in. The console uses session storage for an account-specific checkout reference and purchase amount so a retry can reuse the same purchase attempt. This storage does not contain your API secret, prompt text, or an authentication token saved by our console.

To limit abusive traffic, the service uses the connection IP address supplied by the hosting edge to create a one-way, minute-specific identifier. Our rate-limit database stores that identifier and request counts rather than the raw IP address. Counters become eligible for routine cleanup after ten minutes. Hosting and other providers may separately process connection and operational records.

Creator and campaign links

If you arrive through a tagged link, we may associate its creator or campaign code with your new account to understand which campaigns lead to signups, purchases, and usage. Only limited campaign labels and their timestamps are used for this feature.

The link carries a campaign label, such as the name of a launch. We stop using the account’s campaign label for new events after thirty days and delete expired account-attribution records during routine maintenance. A visit or purchase can appear without a campaign if we have no active label for it.

Website analytics

We measure pageviews automatically to understand what brings people to Oathbreaker and improve the site. Our server sends PostHog the page path, time, referring domain and limited campaign labels. Each pageview has a random event ID. We do not create visitor IDs in your browser, use tracking cookies or fingerprint your device.

We also count new accounts and completed live credit purchases. Those events use a separate random account ID. For a purchase we include the amount, currency and the active campaign label saved with the account, if there is one. Pageviews are counted separately from account events. Our analytics payloads exclude visitor IP addresses, full URL queries, names, emails, payment details, API keys and model content. We do not record sessions.

You can turn analytics off here at any time. We honor Global Privacy Control, Do Not Track and previously saved opt-outs. Your browser can remember an opt-out for up to six months using a preference cookie or local storage. If you are signed in, saving an opt-out also applies to future account events. Contact us about past analytics records or other data requests.

Providers and sharing

We use the following providers for the purposes described here. Providers can also process information for their own security, legal, or operational purposes where their terms permit.

• Clerk: authentication and account sessions. See its privacy policy and customer-data processing terms.
• Refuseless: model inference, including downstream model providers it may use. See its privacy policy. Its policy does not guarantee zero retention by every downstream provider.
• PostHog: site traffic, account and credit-purchase statistics. See its privacy policy.
• Stripe: payments, refunds, fraud prevention, and transaction records. See its privacy policy.
• Cloudflare: website and application hosting, our account database, and network security. See its privacy policy.
• OpenAI / ChatGPT Sites: our former hosting provider. Pre-migration records may remain in retained recovery backups under the Sites terms and data processing addendum.

Information may be processed in the United States and other countries where these providers operate. We do not promise storage in a particular country. We may also disclose information when needed to comply with law, respond to valid legal requests, protect people or the service, or resolve a dispute.

Purposes and retention

We process information to provide your account and requested inference, handle payments and support, protect the service, measure campaign results, and meet legal obligations. Where applicable law requires a legal basis, we rely on performing our agreement with you, our legitimate interests in operating and protecting the service, compliance with legal obligations, and consent where required.

We retain account information while it is needed to provide the service. Billing, usage, security, and support records may remain after account closure where needed for accounting, disputes, fraud prevention, or legal obligations. Provider records and backups follow the relevant provider arrangements. The campaign and rate-limit cleanup practices are described above; they do not set a deletion deadline for other records.

Your choices and requests

You can revoke API keys in your console and contact support@oathbreaker.ai to request account closure or help with your personal information. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your information, object to or restrict processing, withdraw consent, or complain to a privacy regulator.

We may need to verify your control of the account before acting on a request. Some information must be retained for legal, security, or transaction-related reasons. We will explain applicable limits when responding. Please do not send passwords, API secrets, or full payment-card details in a support email.

We will update this page when our practices change and revise the date above. Where required, we will provide additional notice of material changes.