Privacy Policy

What we collect: Your email address, name, and usage data (API requests, tokens, costs, model used, timestamps). We use this to provide the service, show you analytics, and detect cost anomalies.

Provider API keys: The provider API keys you register (OpenAI, Anthropic, Google, Mistral, and 13+ others) are encrypted with AES-256-GCM before storage. We never access them in plaintext except to forward your requests to the provider.

Request bodies: By default, request and response bodies are stored for the retention period you configure (7 days, 30 days, 90 days, 1 year, or forever — see Settings). On paid tiers, bodies are additionally encrypted at rest with a per-user envelope key. You may enable Zero Data Retention to skip body storage entirely while keeping metadata for analytics.

PII redaction: You may opt in to regex-based masking of emails, phone numbers, SSNs, credit-card numbers, and IPv4 addresses before storage. See /security for the full list.

What we don't do: We don't sell your data. We don't train models on your data. We don't share your data with third parties except (a) the AI provider you've asked us to route to, and (b) Polar — our Merchant of Record — for payment processing.

Cookies & analytics: We use a single first-party cookie to keep you signed in. No third-party tracking cookies. No ad networks.

Payments: Payment processing is handled by Polar, which acts as Merchant of Record for invoicing and tax compliance. We don't store your credit-card details.

Data deletion: You can delete your account and all associated data at any time. Email support@trackcost.ai and we'll process within 7 days.

Contact: support@trackcost.ai · For security disclosures, security@trackcost.ai · Parent company, hello@elevian.io