Privacy Policy

Last updated: 11 October 2026.

This Policy explains what personal data we collect when you use zerodaymodel.com and the related API and tools (the “Service”), how we use it, and your rights.

1. Data we collect

• Account data: your email address, a hashed password and email-verification status.
• Usage metadata: for each request — the model used, token counts, cost, status, and timestamps — which we use for billing and limits.
• Prompt and output content: to fulfil a request we transmit your Inputs to the selected third-party model provider and return its Output to you. We do not write prompt or output content, or your API keys, to our request logs. See “AI processing” below.
• Payment data: processed by our payment processors (Stripe, NOWPayments (when enabled)). We receive transaction metadata (amount, status, an order reference) but not your full card number.
• Technical data: IP address and request headers, used transiently for security, abuse prevention, and rate-limiting.

Community content

We store project titles, creator display names, descriptions, Markdown, categories, tags, model references and uploaded files. Public projects and creator display names are visible to visitors and search engines. Unlisted projects are accessible to anyone with the link. Drafts are restricted to their creator. Reports include the reporting account identifier, project identifier, reason and timestamp for operator review. Do not put sensitive personal information in community content.

2. How we use data

• To provide and operate the Service, authenticate you, and route requests.
• To meter usage, process payments, and maintain your credit balance and ledger.
• To secure the Service, prevent abuse, and enforce our Terms and Acceptable Use Policy.
• To comply with legal obligations and respond to lawful requests.

Legal bases (where GDPR applies): performance of a contract, our legitimate interests in operating and securing the Service, and compliance with legal obligations.

3. AI processing and third-party providers

When you make an inference request, your Inputs are sent to the third-party model provider you select so it can generate a response. That provider processes your Inputs under its own terms and privacy practices. We encourage you not to submit sensitive personal data in prompts. We share data only with providers necessary to run the Service.

4. Who we share data with (processors)

• Model providers, currently Abliterated Top and MuAPI, to fulfil inference requests routed to them.
• Payment processors (Stripe, NOWPayments (when enabled)).
• An email/SMTP service delivers verification and password-reset messages.
• Hosting and infrastructure services store and operate the platform database, application and backups.
• Authorities or advisors where required by law or to protect rights and safety.

We do not sell your personal data.

5. Cookies

We use the strictly necessary of_session cookie to keep you signed in across the API platform and Community. It is HttpOnly, SameSite=Strict and Secure on HTTPS, with a one-day lifetime. We do not use advertising or cross-site tracking cookies.

6. Retention

Account controls and integrations: we store API key spending policies, response ratings and optional feedback notes, and balance notification preferences. Email balance alerts require opt-in and enabled mail delivery. If you connect GitHub, your personal access token is stored in a restricted server credential file separate from the platform database; it is removed locally on disconnect. GitHub source copies, original versions for diff comparison and reviewed PR drafts remain with your private workspace until it is deleted. GitHub receives repository changes only when you explicitly create a draft pull request. You can also revoke your token in GitHub settings. Incomplete streamed requests without authoritative provider usage may retain a credit reservation until usage is reconciled.

Private AI workspaces: uploaded source files are stored in your private workspace until you delete them. Only files you select are sent with an AI request to the selected model provider. Enabling edit proposals does not apply edits automatically: you review and accept them separately. We retain one previous version per changed file for Undo, and pending proposals until you review them or they expire after seven days. Private workspace changes do not publish to Community. Common secret filenames and credential patterns are blocked, but you must remove credentials before uploading; these checks cannot detect every secret. Deleted content may remain in rotating backups until they expire.

Playground conversation: we store one active conversation per account, including messages, responses, errors and model settings, up to 100 messages / 200 KB. It remains available after logout and refresh. Starting a new chat replaces the previous conversation in the active database; there is no chat history or archive. Previous content may remain in rotating database backups until those backups expire.

Account, usage, billing and community records are stored in the platform database. The service does not currently implement a general automatic deletion schedule for these records. Community creators can delete their projects and attachments. Deleted data may remain in rotating database backups until those backups expire. Financial records may need to be retained under applicable law. Prompt and output content is not written to our request logs; upstream providers have their own retention practices.

7. Security

We protect data in transit with TLS, store passwords using a strong key-derivation function, store API keys and session tokens as cryptographic digests, and restrict access. No system is perfectly secure; you use the Service at your own risk and should keep your credentials safe.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, export, or restrict processing of your personal data, and to object or withdraw consent. A dedicated privacy contact and a self-service account-deletion feature are not currently available. This does not remove your rights under applicable law. EU/UK users may lodge a complaint with their supervisory authority.

9. International transfers

Your data may be processed in countries other than yours, including where our providers operate. Transfer arrangements depend on the providers involved. This notice does not claim that Standard Contractual Clauses or another specific transfer mechanism have been executed.

10. Children

The Service is not directed to anyone under 18, and we do not knowingly collect their data. If you believe a minor has provided us data, do not upload or continue processing that data.

11. Changes

We may update this Policy. Material changes will be posted here with a new date and, where appropriate, notified to you.

12. Privacy information

A dedicated privacy contact and operator identification are not currently published. ZeroDay Model is the service name, not a statement of incorporation.