Privacy Policy

1. Information We Collect

We collect only the data necessary to operate the caching service and process billing. Here is exactly what we collect — and what we never touch:

Data	Collected?	Purpose
Email address	Yes	Account identification, billing notifications
Password (hashed)	Yes	Account authentication
Request counts	Yes	Usage tracking, billing calculations
Model names	Yes	Cost estimation per request
Cache hit/miss status	Yes	Savings calculation
Request latency	Yes	Performance monitoring
Cost calculations	Yes	Fee computation
Prompt content	No	—
API response content	No	—
Conversation data	No	—
File contents	No	—
Provider API keys	No	—

2. How We Use Information

We use the information we collect solely to:

• Provide the caching service. Routing, caching, and returning AI API responses.
• Calculate savings and billing. Comparing provider pricing against cached responses to determine your savings and our fee.
• Communicate about your account. Sending billing receipts, service updates, and responding to support requests.
• Improve the Service. Analyzing aggregate usage patterns (not individual prompts) to optimize cache hit rates and performance.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. Data Storage & Infrastructure

All infrastructure runs on Cloudflare, including Workers, KV storage, and edge caching. Here's how your data is stored:

• Passwords are hashed with SHA-256 and a unique per-user salt before storage. We never store plaintext passwords.
• Session tokens are stored in Cloudflare KV with a 7-day time-to-live (TTL). Expired tokens are automatically purged.
• Usage statistics (request counts, cache hits, cost calculations) are stored in Cloudflare KV for billing purposes.
• Cache entries are stored as ephemeral edge cache objects and are not linked to your identity.

Cloudflare's infrastructure is distributed globally across their edge network. Data residency is subject to Cloudflare's infrastructure policies.

4. Data We Don't Store

This is the core of our privacy promise. The following data is never stored, logged, or persisted in any form:

• Raw prompts — Your message content is processed in memory, hashed for cache keying, and immediately discarded.
• Raw responses — AI provider responses are forwarded to you and not retained. Only a cache hash exists for duplicate detection.
• Provider API keys — Your OpenAI, Anthropic, or OpenRouter keys are passed through ephemerally to make API calls. They are never logged, stored, or written to disk.

Cache keys are deterministic SHA-256 hashes of the normalized request. It is computationally infeasible to reverse these hashes to recover the original prompt content.

5. Third-Party Services

We use the following third-party services in the operation of CachePilot:

• Cloudflare — Infrastructure, edge computing, KV storage, and DDoS protection. Cloudflare Privacy Policy.
• Paystack — Payment processing for subscription billing. Paystack handles your payment information directly; we do not store card details. Paystack Privacy Policy.
• Google Analytics (optional) — Used for aggregate page view analytics only. No personally identifiable information is sent. Google Analytics can be opted out of or disabled via browser settings.

6. Data Retention

• Account data (email, hashed password) is retained until you delete your account.
• Usage statistics (request counts, cost calculations) are retained for 30 days for billing and audit purposes, then purged.
• Session tokens expire automatically after 7 days and are not renewed unless you log in again.
• Cache entries are ephemeral and have no association with your account identity.

When you delete your account, all account data is permanently removed within 30 days.

7. Your Rights

You have the right to:

• Access your personal data — request a copy of all data we hold about you.
• Correct your personal data — update inaccurate or incomplete information.
• Delete your personal data — request permanent deletion of your account and all associated data.

To exercise any of these rights, email support@cachepilot.dev. We will respond within 30 days.

8. Cookies

CachePilot uses a single session cookie for authentication. Here are its properties:

• HttpOnly — Not accessible via JavaScript.
• Secure — Transmitted only over HTTPS.
• SameSite=Strict — Not sent with cross-origin requests.
• Expiry — Expires after 7 days, matching session token TTL.

We do not use advertising cookies, tracking cookies, or third-party cookies.

9. Security

We take security seriously and implement the following measures:

• SHA-256 password hashing with unique per-user salts. Passwords are never stored in plaintext.
• HTTPS everywhere — All traffic between your application and CachePilot is encrypted in transit.
• No plaintext secrets stored — Provider API keys, session tokens, and passwords are never stored in readable form.
• Cloudflare security — DDoS protection, WAF rules, and edge-level security provided by Cloudflare's infrastructure.

If you discover a security vulnerability, please report it responsibly to support@cachepilot.dev.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at least 30 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you do not agree with the changes, you may delete your account before the effective date.

11. Contact

If you have questions about this Privacy Policy or our data practices, please contact us at support@cachepilot.dev.