Privacy policy

Prompts, outputs and IP addresses have one exception, described below. These lists cover our own systems. Prompts and outputs sent to models labelled Official DeepSeek API are stored by DeepSeek, as described below.

Your account is a random 16-digit account number, and that number is also your login. We keep only a keyed hash of it, so we can never show it to you again. If you lose it, we can't restore access.

API keys work the same way. We store a keyed hash of each key plus its first 10 characters, so you can tell your keys apart in the dashboard. The full key is shown once, when you create it.

Your prompts and the model's outputs pass through our gateway in memory on their way to the model and back. They are not written to our database, our logs or disk, except in the sealed incident record described below. Our abliterated models run on dedicated GPUs operated by our infrastructure provider under a zero-data-retention configuration. Models labelled Official DeepSeek API are the exception: they run on DeepSeek's servers, as described below.

Traffic to this website and to the API reaches our servers through Cloudflare, which terminates TLS and protects the service against DDoS attacks. Prompts and outputs pass through Cloudflare only in transit, and it doesn't cache or keep them for us.

An automated in-memory check scans every prompt before it is forwarded, and every output after it completes (the beginning and end of a very long one), on every model. It refuses child sexual abuse material (CSAM): the request is blocked and a sealed incident record is kept, which we report as the law requires (see Sealed incident records). It also refuses clear, actionable instructions for mass-casualty weapons (CBRN weapons or mass-casualty explosives); those requests are not recorded. Neither carries automatic account action. No human reads prompts or outputs outside that sealed record, and the text the check reads is not stored. The acceptable use policy has the details.

Models labelled Official DeepSeek API are DeepSeek's stock models. We don't run them: your request passes through our gateway as described above and is then sent to DeepSeek's official API, which generates the answer.

Prompts and outputs for these models are sent to DeepSeek, processed and stored in the People's Republic of China under DeepSeek's privacy policy, and may be used by DeepSeek to train its models. DeepSeek offers no zero-data-retention option. Our promise not to store prompts and outputs covers our own systems only; what DeepSeek keeps, and for how long, is governed by the DeepSeek Privacy Policy. If that matters to you, use one of our abliterated models instead.

With each of these requests we send DeepSeek a pseudonymous identifier for your account: a keyed hash that is the same for all your keys and is not your account number, an API key or your IP address. DeepSeek uses it to keep its prompt cache and its content-safety handling separate per customer. Any user or user_id value you send is replaced by it. DeepSeek doesn't receive your account number, your API key, your IP address or your payment details from us.

Our in-memory safety check runs on these requests the same way as on every other model. DeepSeek may also decline requests on its side under its DeepSeek Terms of Use.

For every API request we record:

• the time, request id and endpoint;
• the API key and model used;
• input, cached input and output token counts;
• the cost and the outcome (completed, cancelled by the client, or upstream error);
• the latency and the time to first token, in milliseconds.

We keep these rows for 30 days so you can inspect recent usage and so we can investigate abuse reports. After 30 days they are rolled up into daily totals per account and model (request count, token counts and cost) and the individual rows are deleted. Your credit ledger and invoice history are kept as the record of your balance. Support tickets keep the subject and messages you and we write until the ticket is closed (by you, by us, or automatically 14 days after our last reply if you don't answer), and are deleted with all their messages 180 days after closing.

IP addresses are held in memory only. We use them while a request is being handled for rate limiting, login throttling and the free-trial and bonus checks, and we never write them to our database or logs. The only exception is the sealed incident record described below. Cloudflare, which carries the connection to us, also sees your IP address in transit.

To allow one free trial per network, we keep an HMAC (a keyed one-way hash) of the IPv4 /24 or IPv6 /48 your address belongs to for 30 days, not linked to your account. Free credit isn't offered to datacenter, VPN or Tor networks, which we check in memory against public address lists.

The deposit bonus is also once per network. Each invoice stores the HMAC of your network prefix (the IPv4 /24 or IPv6 /48) with your account for up to 30 days. When a bonus is granted, we keep a separate copy of that HMAC, not linked to your account, for 90 days. An HMAC can't be reversed into an address, and a daily job deletes these records once they expire. Login-attempt counters use the same kind of HMAC, of the /24 or /48 and, for IPv6, also of the enclosing /32, and expire within minutes.

When content is flagged as child sexual abuse material, we keep the request, any output, its source IP, time, account, key prefix and model in a record sealed with public-key encryption: the running service can't open it, only the operator's separately held key can. We delete it after one year and report it as the law requires, as set out in the acceptable use policy.

Payments are processed by our own self-hosted BTCPay Server, with no third-party payment processor and no KYC. It records each invoice (amount, status and the account it credits), the payment address it generated and the on-chain transactions that paid it. Bitcoin and Litecoin payments are recorded on transparent blockchains and are public by nature. If that matters to you, pay with Monero.

Email recovery isn't offered, so we don't ask for an email address. Your account number is your only login.

We set no cookies other than these two:

• __Host-sid: your login session. It is httpOnly, sent only over HTTPS to this site, and expires after 30 days, and we store only a hash of it.
• ref: the referral code from a ?ref= link, kept for 30 days so the referrer gets credit when you sign up.

There are no analytics, tracking pixels or advertising scripts. Playground conversations stay in your browser's memory and are gone when you close or reload the tab.

We don't sell or share your data. Using a model labelled Official DeepSeek API sends that request to DeepSeek, as described above. If we receive a valid legal request, we can only provide what this page says we have, and that never includes your prompts or outputs (except for the sealed record described above).

This service is operated by AbliteratedLLM ((jurisdiction to be confirmed)). For privacy questions, write to legal@abliteratedllm.dev. To report abuse, see the report page. If this policy changes, we'll update the date at the top of this page.