What we log, and for how long

Conversations & messages

Every message you send and receive is stored in full — including any file or image you attach — so your conversation history stays readable when you come back to it. Routing metadata (which model answered, complexity score, token counts, cost) is stored alongside each message; this is what powers your usage dashboard.

• ·Free tier — a conversation you haven't touched in 7 days is automatically and permanently deleted by a daily cleanup job. This is a real, running process, not a stated policy — it runs every day regardless of whether anyone requests it.
• ·Paid tiers — nothing is auto-deleted. Conversations are kept until you delete them yourself (any time, from the chat sidebar — this is an immediate, permanent hard delete, not a soft-hide) or delete your account.

Usage logs

Separately from message content, we keep a lightweight metering record per request — which model, token counts, cost, and whether it came from the chat UI or a developer API key. This record never contains your message content, only the numbers needed to bill and show your usage history. It is kept for the life of your account.

API keys

We store a one-way SHA-256 hash of your API key, never the key itself — once issued, we genuinely cannot recover the plaintext value even if we wanted to. Only the first few characters (the prefix you see in your dashboard) are kept in readable form. Deleting a key from your dashboard removes it immediately and permanently.

Payment data

We never receive or store your card number, CVV, or full payment details — Stripe, Razorpay, and PayPal each handle that directly and only send us a transaction reference and the amount charged. What we keep is the minimum needed for reconciliation and your purchase history: the transaction ID, amount, currency, pack purchased, and timestamp. These records are retained for as long as your account exists, and afterward as required by Indian tax and financial record-keeping law.

IP address

Your IP is used briefly to enforce rate limits and to pick a default currency — this happens in a fast-expiring cache, not a permanent database record, and the value ages out on its own within hours. IP addresses may also appear in operational application logs (used for abuse detection and debugging), retained per our infrastructure providers' standard log-retention windows, not in a separate database table we query or report from.

What we checked before publishing this page

Before writing the claims above, we audited the actual logging and storage code rather than describing an intended policy:

• ·No application log statement writes raw message content, an API key, or a session token to logs.
• ·No card number, CVV, or other raw payment credential is ever received by our servers in the first place — payment processors handle that directly.
• ·The free-tier 7-day auto-delete described above is a real, currently-running scheduled job, checked directly against its code.
• ·Account deletion (see below) is a real, working feature you can trigger yourself — not a manual request with nothing behind it.

Deleting your account

Settings → Data & Privacy → Delete my account removes your account and everything tied to it — conversations, messages, API keys, usage logs, credit balances — in one immediate, irreversible action, along with your underlying sign-in identity. There is no recovery window once confirmed.

Contact

Questions about any of the above: MAVPRO Technologies · DirΛIght · privacy@dirAIght.com. See also our Privacy Policy.