Privacy Policy

Last updated: November 9, 2026

This policy explains what SteadyRouter, operated by the SteadyRouter team ("we", "us"), collects when you use steadyrouter.com and api.steadyrouter.com, and what we do with it.

What we collect

• Account information: your username, your email address if you provide one, and your password (stored only as a hash). If you enable two-factor authentication, we store what is needed to verify it. If you sign in with Google, see "Signing in with Google" below.
• Usage records: for each API request we record the time, model, API key name, token counts, cost, duration, request ID, the group that served it and the supplier behind that group. This is what you see in your console's usage logs, except the supplier.
• IP addresses in usage records: only if you turn on IP logging in your account settings.
• Error records: when a request fails, we keep the error message, which may include text returned by the supplier.
• Payments: the amount, time, method and order number of each top-up. Payments are made on the page of our payment provider (Waffo); card and account details never reach us. The payment confirmation the provider sends us, which can include details you entered on its page, is kept in our server logs.
• Support messages: emails you send to support@steadyrouter.com.
• Web server logs: IP address, time, requested path and response status, kept for security and troubleshooting.

Signing in with Google

If you sign in with Google, we ask Google only for the basic sign-in permissions (openid, email, profile) and keep:

• your Google account ID, which links your Google account to your SteadyRouter account;
• your email address, which becomes your account email;
• your name, which becomes your display name in the console.

Google's reply can also include your profile picture; we do not keep it. The access token Google issues is used once to fetch the details above and is not stored.

We use this information only to sign you in and to contact you about your account and the service, such as password resets and billing or service notices. We do not ask for access to your Gmail, Drive, contacts, calendar or any other Google data. We do not sell this information or share it with our suppliers or anyone else.

To unlink Google, open Profile → Account Bindings in the console. If Google is your only way to sign in, first set a password with "Forgot password" on the sign-in page, using the same email address. You can also remove SteadyRouter's access in your Google Account at any time (myaccount.google.com/permissions). Unlinking or removing access stops future Google sign-ins but does not delete your SteadyRouter account; to delete it and the information above, email support@steadyrouter.com.

What we do not store

We do not store the content of your requests (prompts, messages, files) or the content of model responses, except for the files generated through our Coze plugin (see below).

Our Coze plugin

Our Coze plugin reaches SteadyRouter through a relay that we run on Cloudflare Workers. The relay passes your prompt, the links to any reference images and your API key on to SteadyRouter, and does not log them. The images and videos it generates are stored in Cloudflare R2, in Cloudflare's Western North America region, so that Coze can show them, and are deleted automatically after 15 days. Until then, anyone who has a file's link can open it.

Suppliers who process your requests

To answer a request, we send its content to the upstream supplier serving that model. Suppliers process it under their own terms and may keep it according to their own policies; we cannot control or verify how they handle it. Do not send data that you are not allowed to share with third parties.

If smart routing is on for your API key and a request fails in one group, we retry it in another group, so its content may be sent to more than one supplier.

Account-pool groups (Pool in the name), mixed-source groups (Mixed in the name), and Midjourney and music groups (MJ or Music in the name) come from sources with less transparency about how data is handled. Avoid them for sensitive data. Because Auto without your own list of groups can use any group that offers the model, for sensitive data set your API key to groups that run on a cloud provider (Bedrock, Azure or Vertex in the name), are described as an official API relay (API in the name), or are described as the official API or AWS, as stated by the supplier (Cloud in the name): either one such group, or Auto with a list that contains only such groups.

How we use information

• to provide the service, bill usage and show you your usage history;
• to route requests, measure each group's availability and speed, detect failing suppliers and fix problems. Availability and speed figures for each group are shown publicly in aggregate and do not identify you;
• to prevent fraud and abuse;
• to reconcile our charges with our suppliers' charges.

We do not sell personal information, and we do not use advertising or analytics trackers.

Cookies and local storage

We use a session cookie to keep you signed in, and your browser's local storage to remember preferences such as theme and language.

Where data is stored

Our servers are located in the United States. Backups are encrypted before they leave the server.

Retention

Account information is kept while your account exists. Usage and payment records are kept as long as needed for billing, accounting and dispute handling.

Your choices

You can view your usage records in the console at any time. You can ask us to delete your account and the personal information associated with it, except records we must keep for billing or legal reasons.

To ask for a copy or deletion of your data, or for any privacy question, email support@steadyrouter.com.

Changes to this policy

We may update this policy. The date at the top shows the latest version.