Legal
Privacy policy
Draft. This page is not yet in effect and will be completed before payments open.
What we collect
We process information needed to sign you in, manage access, serve requests, keep accounts secure and account for usage and payments. This includes account identifiers, contact information you provide, access requests, technical request metadata, usage and payment records. Your prompts, files, tool inputs and generated output must be processed to provide inference. Avoid submitting information you are not authorized to share.
Sign-in and account data
Supabase provides website authentication. Depending on your sign-in method, we receive your email, provider account identifiers or wallet address and verification state. We also keep access approval, team membership and account settings. Product news consent is optional and separate from service access. Operational emails may be sent to confirm sign-in or explain an account action.
API keys and browser storage
The website saves your spending key and pending payment identifiers in this browser so you can resume work. The credential registry uses key digests. A downloaded private backup contains secrets and must be protected. If you opt into the passkey vault, an encrypted backup is stored for that feature. Signing out is not a substitute for revoking a key or removing a saved backup from a shared device.
Payments
Stripe processes card payments; Lyber does not collect your full card number or card security code. Lyber retains payment identifiers, amounts, currency, credit postings and refund or dispute observations. Solana payments are recorded on a public blockchain, where transaction details and wallet addresses may be visible independently of Lyber. Never put private information in a transaction memo.
Requests and usage records
The standard usage ledger records request and account identifiers, model and revision, token counts, request state, timing and charges. It is designed to exclude prompt text, answers, tool arguments and raw API keys. Request content is still processed by the selected model runtime and infrastructure. This is not a promise of zero retention across every provider; review the selected route's disclosures before sending sensitive content.
Website analytics
The website uses Vercel Web Analytics and Speed Insights to count visits, see which pages and links bring people here and measure how fast pages load. Neither sets cookies. Before anything is sent, the page address is cut to its path and campaign tags, so invitation, sign-in, payment and referral codes in links are not recorded. Product events, such as starting sign-up or adding credit, carry only short labels and amounts, never your email, keys or account identifiers.
Service providers
Our service uses providers for hosting, authentication, databases, transactional email, payments and model compute. Current platform integrations include Vercel, Supabase, Railway, Resend and Stripe. Compute providers depend on the selected route. These providers process relevant information to operate their part of the service and may process it in other countries. We do not represent every route as having identical retention or training terms.
Retention
We retain account and operational information for as long as needed to provide the service, resolve billing or security issues and meet applicable recordkeeping obligations. Account closure does not immediately erase payment records, audit evidence, public blockchain data or every backup. We have not published a universal automatic deletion period. The final notice must describe any additional retention commitments before paid access opens.
Your choices and rights
You can change optional mailing consent, manage keys and request an account data export or closure from the dashboard. Contact support for access, correction or deletion requests and questions about applicable privacy rights. We may need to verify ownership without asking for your API or recovery secret. Some records may need to be retained for legal, security or accounting reasons; we will explain relevant limits.
Contact
Use lyber.ai/support for privacy questions and requests. Send only the information needed to identify the issue, such as an account contact and request or payment ID. Do not include secret keys or unnecessary sensitive content. A monitored contact address must be published with the effective notice.