Privacy

What is not stored

• The prompt and response text of API requests (/v1/chat/completions, /v1/completions, /v1/embeddings) — not in logs, not in the database, not in any system alongside them.
• Headers that identify your client are not passed on to the model provider; the request reaches upstream under uttapen's own identity.
• An API key is stored as a SHA-256 hash. The key itself is shown once, at the moment you create it.

What is stored

• Metadata for each request: model, input and output token counts, cost, timestamp, status, client IP, key id. Used for billing, for limits, and to defend your account.
• Your mobile number (that is how you sign in), plus your email and invoicing details if you enter them yourself.
• Wallet transactions and the payment details the gateway returns (reference number, masked card).
• One exception — chat inside the dashboard: conversation history and attached files are your own data and are kept so the history can be shown back to you. You can delete any conversation, and deleting your account deletes all of them.

The route a request takes

The panel, the wallet and the keys sit on a server inside Iran. The model call travels through a stateless relay outside Iran to the model provider (OpenRouter, and through it the model maker). The relay stores nothing. What the model makers retain is governed by their own policies; for sensitive data, use models whose policy is not to train on what you send.

Deleting your account

Ask support and the account, along with every conversation, is deleted. Financial records (invoices and transactions) are kept for as long as the law requires.