We count your requests and keep none of your text.

What we store

When you create a key

• Your email address.
• What you told us you're building, and the dialects you ticked.
• A SHA-256 hash of your API key, and its first 8 characters so we can recognise it when you write to us. We never store the full key.
• A SHA-256 hash of your IP address, used to limit key sign-ups to 3 per network per day. Someone with enough effort could match that hash back to an address, so we treat it as personal data.
• The time you signed up, your token allowance and the tokens used so far.

For each API request

• Time, key id, model id, dialect, and whether the request streamed.
• HTTP status.
• Prompt, completion and cached token counts.
• Total latency and time to first token.

We also keep short-lived counters per key and per IP hash to enforce rate limits. The playground on the home page counts requests per IP hash per hour.

What we don't store

We do not store the text of your prompts or the model's replies. Our API code writes only the fields listed above to its database, and it does not log request or response bodies. The same applies to messages typed into the playground.

Your text does pass through two places while a request runs. Cloudflare carries it to our code and back. The GPU server holds it in memory while it generates a reply, and keeps a short-term cache of recent prompts in GPU memory to answer faster. We have not turned on the model server's request logging. About 20 minutes after the last request, we destroy the rented server and its disk.

In auto-detect mode (:arabic), we first send up to 2,000 characters of your last message to the same model to classify the dialect. That call stays on our GPU.

Where requests run

• Cloudflare runs the API at api.lahja.dev on its Workers platform, and hosts the database (D1) that holds the records above.
• Vast.ai rents us the GPU server that runs the model. We only accept verified datacenter hosts. The server reaches Cloudflare through an encrypted Cloudflare Tunnel, and our API authenticates to it with a private key.

Cloudflare and Vast.ai, plus the datacenter that hosts the GPU, are our subprocessors. We do not yet pin the GPU to a particular country. If you need a specific region, tell us before you send production traffic.

How we use it

We use the records above to run the service, enforce limits, fix problems, measure speed, and contact you about your key and about pricing. We do not train models on your data, sell it, or use it for advertising.

Deletion and access

We keep your records while your key exists. Email bassam@bassame.com from the address you signed up with, and we will send you a copy of your records or delete them and revoke your key. If this policy changes, we will email you before the change takes effect.