Privacy Policy
What Tium collects, what it never stores, and exactly which third parties can see a request. If you only read one section, read the second.
Effective 28 July 2026
Who this covers
This policy covers tium.ai, the Tium dashboard, and the inference API served from our gateway. Tium is the controller for your account data and the processor for the requests you send through the API.
It does not cover whatever you build with the API. If your own application collects personal data from your users and passes it to us in a prompt, you are the controller of that data and this policy describes what we do with it on your behalf.
We do not store your prompts
The gateway reads your request, forwards it to the model that answers it, and streams the response back to you. It does not write the request body or the response body to a database, a log, or a file. When the connection closes, the only thing left is a row of numbers.
That row is:
- a request id, for support correlation
- the model requested
- input, cached, and output token counts
- the weighted-token total and the multiplier applied
- time to first token, total latency, and a status code
- the API key the request authenticated with
This is a property of how the gateway is built, not a promise about how carefully we delete things: there is no deletion step because there is no write. It is also the reason we cannot help you recover a response you lost: we never had it.
The important limit: while your request is being answered, its full content necessarily passes to the inference provider serving that model. What they retain is governed by their terms, not ours. Section four names every one of them.
What we do collect
Account
GitHub account id, username, email address, and the date your GitHub account was created.
Why: To identify you at sign-in, contact you about the service, and, using the account age, to judge whether a new account qualifies for trial credit without being an abuse vector.
Kept: For as long as the account exists, then 30 days after deletion.
API keys
A SHA-256 hash of each key, its visible prefix, and its last four characters. Never the key itself.
Why: To authenticate your requests and to let you recognise your own keys in the dashboard. Because only the hash is stored, we cannot show you a key again after you create it, and neither can anyone who obtains our database.
Kept: Until you revoke the key, then 90 days.
Usage metadata
Per request: an id, the model, token counts, weighted tokens, latency, and a status code. Not the request or response content.
Why: To bill you accurately, to show you your own usage, and to detect metering faults on our side.
Kept: 24 months, which covers the period in which a billing dispute can reasonably be raised.
Billing
Stripe customer and subscription identifiers, your plan, period dates, and an append-only ledger of credits bought and spent.
Why: To run subscriptions and credits, and to be able to reconstruct any balance we have ever shown you.
Kept: Seven years, for tax and accounting obligations. This outlives account deletion by necessity.
Waitlist
Email address, an indication of how much you use agent tooling, and the referring page.
Why: To tell you when access opens and to understand which channels bring people who actually sign up.
Kept: Until you ask to be removed, or 24 months after launch.
We do not buy data about you, we do not sell or share your data for advertising, and we run no advertising trackers. Traffic measurement on the marketing pages is cookieless and aggregate: it carries no account identifier and cannot be joined to your usage.
Who else can see your data
Running a resale API means your requests are answered by someone else's hardware. Pretending otherwise would be the single most misleading thing this page could do, so here is the complete list.
Currently processing
| Party | Role | Region |
|---|---|---|
| Inference provider (current endpoint) | Runs the model that answers your requestThe full content of your request (messages, system prompt, and any tool definitions) for the duration of the request, plus the response streamed back. | Varies by deployment; see the status page for the live endpoint |
| Database hosting | Managed Postgres: the account, billing, and usage databaseYour account record, API key hashes, usage metadata, and credit ledger. No prompt content. | European Union (Germany) |
| Application hosting | Application hosting, plus cookieless traffic and Web Vitals telemetryHTTP request metadata for pages served, and aggregate performance measurements that carry no account identifier. | United States / global edge |
| Stripe | Payment processingYour payment details, which you enter with Stripe directly, plus billing email and the amounts charged. We never receive or store card numbers. | United States |
| Sign-in provider | Sign-in (OAuth)An authentication request. Returns your account id, username, email, and account creation date to us. | United States |
| Email delivery | Transactional email deliveryYour email address and the contents of service emails: balance warnings and account notices. No marketing email is sent through it. | United States |
Not yet processing requests
As the model catalogue grows, we will route requests for certain models directly to the labs that built them. None of them has received any customer request yet, but we are telling you now, before it happens, rather than after.
| Party | Role | Region |
|---|---|---|
| Additional inference providers | Origin-lab inference APIs, added as the model catalogue growsRequest and response content, once the models they serve are added to the catalogue. | China |
| Additional inference providers | Origin-lab inference APIs, added as the model catalogue growsRequest and response content, once the models they serve are added to the catalogue. | France (EU) |
Some of this routing goes to China, some to the European Union. If routing your traffic to a particular jurisdiction is unacceptable to you, do not treat this list as advisory: write to privacy@tium.ai before you integrate, and we will tell you which endpoint currently serves which model.
We will publish a change to this list before a new provider begins receiving traffic, not after. If a change is unacceptable to you, you may cancel and request a refund of unused credits under section three of the Terms.
International transfers
Tium is established in the United States, but your account data (your profile, keys, usage records, and credit ledger) is stored in the European Union. If you are in the EEA or the United Kingdom, that data does not leave it.
Our gateway (the server your requests actually connect to) also runs in the European Union. It holds your API key hashes and a short-lived queue of usage records; it does not hold request content.
Your request content is a separate question, and the honest answer is that it goes wherever the model you chose is served from. That may be outside the EEA, including China. It is not stored at either end by us, but it is transmitted, and section four says exactly to whom.
Jurisdictions differ in what protection they offer and in what access local authorities may have to data held there. We rely on standard contractual clauses with providers who offer them, and on your explicit choice of model where they do not. Because model choice is yours on every request, you retain direct control over where your request content goes; the model list documents which provider serves which model.
Your rights
You can see your account data, correct it, export it, or delete it. Most of it is already in the dashboard: your keys, your usage, your ledger.
Deleting your account removes your profile and revokes your keys immediately. Two things survive, and you should know which: usage rows are kept for 24 months so a billing dispute can be settled, and billing records are kept for seven years because tax law requires it. Neither contains prompt content.
If you are covered by the GDPR or UK GDPR you also have the right to object to processing, to restrict it, and to complain to your national supervisory authority. If you are a California resident you have the rights to know, delete, correct, and opt out of sale or sharing, but we do neither, so the last one has nothing to act on.
Write to privacy@tium.ai from your account address. We answer within 30 days and we do not charge for it.
Security
API keys are stored only as SHA-256 hashes. Someone who obtained our database could not use them, and neither can we: that is why a key is shown once and never again.
Card details never reach our servers; Stripe collects them directly and we hold only their customer identifier. Database access is restricted to the application's service credentials, and every user-facing table has row-level security enabled with no public policy, so nothing is reachable with a public key.
No system is perfect. If we discover a breach affecting your personal data, we will tell you and the relevant regulator within 72 hours of becoming aware of it, and we will tell you what actually happened rather than the smallest true thing we can say.
Children
The service is not directed at anyone under 16, and we do not knowingly collect their data. If you believe a child has created an account, write to privacy@tium.ai and we will remove it.
Changes to this policy
When something material changes (a new subprocessor, a new category of data, a narrowed right), we update the effective date at the top and email account holders before it takes effect. Cosmetic edits do not move the date, because a date that moves for typos is one nobody reads.
Questions about any of this: support@tium.ai.