Legal

Privacy policy

Effective 6 October 2026. tokenflow is operated by FlySearch (“we”).

This policy covers the tokenflow website (tokenflow.dev), the console (console.tokenflow.dev) and the inference API (api.tokenflow.dev).

What we collect

• Account details. When you accept an invitation and sign in, we keep your email address and name. If you sign in with Google, Google tells us your email address, name, profile picture and whether the address is verified; we do not ask for access to anything else in your Google account.
• API keys. We store a one-way hash of each key, never the key itself. A key is shown once, when it is created.
• Usage records. For every API request: the time, the key and organization it belongs to, the model, the number of cached input, uncached input and output tokens, the number of images, and which of our machines served it. We use these to enforce quotas, bill you and run the service.
• Request content. Some of our servers record the prompts you send and the responses they return, so we can investigate faults and improve the service. These records are kept for at most 7 days and then deleted.
• Security logs. IP addresses and request metadata, used to rate-limit and to investigate abuse and faults. Console actions that change settings are written to an audit log together with the person who made them.

How we use it

• To provide, meter, bill and secure the service, and to contact you about your account.
• We do not sell personal data and do not use it for advertising.

Who processes it for us

• Cloudflare hosts the website, console and API gateway and stores account and usage data.
• Google handles sign-in when you choose “Sign in with Google”.
• Compute. Requests are processed on the GPU servers that run the models, to produce a response.

These providers may process data outside your country.

How long we keep it

• Account details: while your account exists.
• Request content (prompts and responses): at most 7 days.
• Usage records and audit logs: as long as needed for billing, accounting and security.

Your choices

You can ask us for a copy of your personal data, to correct it, or to delete your account, by writing to privacy@tokenflow.dev. Records we must keep for billing or legal reasons are kept for as long as required.

Changes

We will post changes on this page and update the date above. For material changes we will also tell account holders by email.

Contact

Privacy questions: privacy@tokenflow.dev. Anything else: support@tokenflow.dev.