Draft v0.1 · not legal advice

Privacy Policy

What the gateway processes, where it goes, and what it deliberately does not keep.

Draft — not legal advice. This page describes what tokencoup's shipped code currently does; it is not a binding policy. The operating entity, jurisdiction, effective date, retention schedule and contact address are undecided. The service is not live for payments and no personal data is currently collected from a live deployment. A qualified lawyer must review this before launch.

1. Scope

tokencoup runs a static AI-agent directory and a token gateway in front of Baidu Qianfan. This notice covers the gateway (API keys, usage metering, billing). The directory pages are static: they have no accounts, no sign-in, no cookies, no analytics and no advertising trackers.

Nothing here should be read as a final privacy notice. Until an operating entity and a lawful basis are confirmed, treat every bracketed item as open.

2. What the gateway processes

Data	Example	Storage	Purpose
Gateway API key	`rf_…`	SHA-256 hash only, in the gateway database	Authentication
Key metadata	owner, plan, status, created_at	Gateway database	Plan limits, revocation
Subscription & usage ledger	token count, timestamp, mode, edition, billed amount	Gateway database	Quota, billing, reconciliation
Audit log	edition, mode, key id, token count	Server-side stdout	Operations, abuse detection
Provider key (Mode A)	your Qianfan key	Not stored; forwarded to the upstream	Request forwarding
Payment / card data	—	Not collected — payments not integrated	—
Cookies / analytics	—	None on static pages	—

The audit log contains no prompt content and is never returned in an API response. Request bodies are passed through to Qianfan, not persisted by tokencoup on the international edition.

3. Why we process it

Authenticate requests and associate them with a plan.
Rate limit per gateway key (60-second sliding window).
Meter and bill Mode B usage on successful responses.
Reconcile the usage ledger against invoices.
Prevent abuse and investigate failed or anomalous calls.

Anticipated legal bases, to be confirmed by counsel: performance of a contract (providing the gateway you subscribed to) and legitimate interests (security and abuse prevention). Where consent is the basis, it will be requested separately and can be withdrawn.

4. Where data goes

Component	Role	Location	Note
Cloudflare Pages	Static site hosting	Global edge	Serves these pages; no gateway request bodies
Cloudflare AI Gateway	International path only	Cloudflare edge	`collect_logs=false` — no request/response bodies stored
Baidu Qianfan International	International upstream	Overseas node — region unverified	Receives your request body
Baidu Qianfan Domestic	Domestic upstream	Mainland China	S2 closed path, domestic edition only
GitHub	Directory data source	Public repositories	Public repository metadata only

The actual data-residency region of Qianfan International is unverified. It is the single factual dependency behind the S1 design and must be confirmed in the console before launch. See the Cross-border notice.

5. Domestic edition

The domestic edition keeps all traffic inside mainland China, uses the domestic Qianfan endpoint as upstream, and never routes through the Cloudflare edge. In the current gateway/config.py, log_prompt is true — prompt logging is enabled on this edition.

Open item. COMPLIANCE_C2.md proposed log_prompt=false for the domestic edition, but the shipped config sets it to true. This contradiction must be resolved and the notice updated before launch; do not treat this page as the final word on domestic logging.

6. Retention

No retention schedule is fixed yet. The C2 plan proposes retaining billing metadata for 30 days, while the usage ledger must be kept long enough to support invoices, refunds and tax audit. The final periods depend on the operating entity and its jurisdiction and will be published here before launch.

7. Security

Gateway keys are stored as one-way hashes; the plaintext is shown once at creation.
Credential files live in secrets/, excluded from the repository by .gitignore.
Provider keys are forwarded, never written to the database.
All public endpoints are served over HTTPS.
Key-edition validation blocks a domestic key from serving an overseas request.

This is a reference implementation. A penetration test, access-control review and incident-response plan have not been completed.

8. Your rights

Depending on where you live, you may ask to access, correct, delete, restrict, export or object to the processing of your personal data, and to complain to a supervisory authority. Because the account system is not live, there is no self-service channel yet.

Contact: to be designated. A data-request address and response procedure will be published before any personal data is collected from a live service.

9. Children

The service is not directed at minors and no age assurance exists yet. A minimum age and a handling procedure will be defined before launch.

10. Changes and contact

This draft will be replaced by a reviewed policy carrying an effective date, the legal entity name, its registration number, a contact address and a changelog. Material changes will be announced before they take effect.