Privacy Policy

1. Scope and operator

This policy applies to crax-gpt at gpt.crax.lol, its compatible API, and connected crax-gpt features. The service is operated as an independent personal project by the crax-gpt operator, who acts as the controller of personal data handled by crax-gpt. The service is not affiliated with the companies whose model or product names appear in it.

Questions and privacy requests can be submitted through the crax-gpt Discord. Discord is currently the published contact channel.

2. Data we collect

Not collected for business purposes: crax-gpt does not take payment details, run targeted advertising, sell personal data, or add advertising/analytics trackers. Avoid submitting passwords, private keys, confidential records, or sensitive personal data.

3. Conversations and generated content

Your saved chat list and conversation history are stored in your browser, not in crax-gpt’s user database. Clearing chats or site storage removes that browser copy, and chats do not automatically sync across browsers or devices.

When you send a message, the current prompt and any conversation context included by the client pass through crax-gpt’s server and are sent to the AI model provider or routing service needed to answer. Attachments may be uploaded to a routing or model service. crax-gpt processes this content to return the response and does not intentionally add it to the persistent account database or the in-memory usage dashboard. Downstream providers may log or retain requests under their own terms and technical practices, which crax-gpt does not control.

Features such as conversation compaction send the relevant conversation content to a model to produce a summary. Using a different device does not restore local chats because crax-gpt has no server-side chat-history sync.

4. Why we use data and our legal bases

• Provide the service and perform the user agreement: route AI requests, return responses, authenticate accounts and API calls, maintain sessions, show usage, and operate optional features you request.
• Legitimate interests in operating a safe, reliable free service: rate limiting, preventing duplicate automated registrations, detecting abuse, securing credentials, diagnosing failures, and understanding aggregate/model-level load. These activities are limited to what is reasonably necessary and balanced against user privacy.
• Your choice or consent: link an optional Discord identity or store optional local profile information. You can unlink Discord and clear local data.
• Legal obligations and protection of rights: respond to valid legal requests, investigate unlawful use, and establish or defend legal claims where required.

5. Who receives data

• AI model and routing services receive the request content and technical data needed to generate an answer. The exact recipient depends on the model and may change as availability changes.
• Hosting, network, and security services may process IP addresses, headers, and traffic needed to deliver and protect the site.
• Google Fonts and jsDelivr receive ordinary network data such as your IP address and user agent when your browser downloads fonts or interface libraries from them.
• Discord processes data if you follow a Discord link, connect an account using OAuth, or use a Discord bot. OAuth requests only the identify scope.
• Search, URL-reading, image, video, or other tool providers receive the query, URL, media, or prompt necessary when you invoke a server-run tool.
• Authorities or affected parties may receive data where disclosure is legally required or reasonably necessary to protect users, the service, or others.

crax-gpt does not sell personal data or share it for cross-context behavioural advertising.

6. Cookies, browser storage, and sessions

crax-gpt does not set advertising cookies. The app uses localStorage for chats, preferences, local profile details, notices, and the sign-in session; sessionStorage may cache model data until the tab session ends. A session token is signed by crax-gpt, identifies the server-side user ID, contains issue/expiry timestamps, and normally expires after 30 days. It is sent to crax-gpt in the authorization header. Signing out removes the browser copy but does not itself delete the server-side account.

Third-party resources or destinations may use their own storage under their policies. Browser privacy settings can block storage, but parts of the app may stop working.

7. API and tools

For client-defined tool_calls, your application decides whether to execute the call and what result to send back; crax-gpt does not gain access to your computer merely because a model proposed a tool call. Built-in server tools—including search, URL retrieval, and media generation where available—are executed by crax-gpt and necessarily disclose the tool input to relevant third parties. URLs fetched by tools may also learn the server’s network address and receive ordinary request headers.

8. Retention

• Local chats and preferences: until you delete them, clear site data, or the browser removes them.
• Account record: retained while the account exists and as needed for security, legal compliance, and dispute handling. There is no self-service account-delete button; you can request deletion through the contact channel below.
• Access-key and API-key hashes/metadata: access-key data remains with the account. Revoking an API key removes that key’s stored record. Expired API-key records may remain until revoked or the account is deleted.
• Daily usage: the stored day’s counters are replaced when usage is initialized for a later UTC day; the last stored counters may remain until later account activity or deletion.
• Discord link: until you unlink it or the account is deleted. Short-lived OAuth state is held in memory for up to 10 minutes.
• Operational telemetry: the admin dashboard holds a memory-only rolling buffer of up to 5,000 usage events (timestamp, model/backend and IP), which disappears on process restart or as newer events replace it.
• Rate limits, security logs, and blocks: retained for the applicable limit/block window or as long as reasonably needed for abuse prevention and troubleshooting. Hosting-level log retention may depend on the infrastructure provider.

Data may be kept longer where necessary to comply with law, resolve disputes, investigate abuse, or protect legal rights.

9. Security and automated abuse controls

Access and API secrets are stored as salted scrypt hashes rather than plaintext, session tokens are cryptographically signed, and sensitive endpoints are rate limited. No internet service is completely secure, so crax-gpt cannot guarantee that data will never be lost, exposed, or misused. Keep access and API keys secret and revoke compromised API keys promptly.

Registration and login controls automatically reject some requests based on IP rate limits, browser signals, interaction timing, or detected automation. These controls affect access to the service but are not intended to make decisions with legal or similarly significant effects. Contact the operator if you believe a check was wrong.

10. International processing

crax-gpt and its providers may process data in countries other than yours, including outside the EEA, UK, or Switzerland. Privacy protections may differ by location. Where data-protection law requires a transfer mechanism, the relevant service provider or controller must rely on an applicable adequacy decision, contractual safeguard, or permitted exception. Contact the operator for information available about a particular transfer.

11. Children

The service is not directed to children. You must be at least 13 and old enough to consent to use of an online service and processing of your data where you live; a higher local age applies where required. Users under 18 should have permission from a parent or legal guardian. If you believe a child used the service contrary to this section, contact the operator so the situation can be reviewed.

12. Your choices and privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data; withdraw consent where processing relies on consent; and complain to your local data-protection authority. These rights can be subject to legal exceptions and identity verification.

• Delete or export local chats using the app’s data controls, or clear the site’s browser storage.
• Revoke API keys and unlink Discord in account settings.
• Submit account access, correction, or deletion requests through Discord. Include enough account information to verify the request, but never post a full secret key publicly.

EEA users may complain to their national supervisory authority; users in Ireland can contact the Data Protection Commission.

13. Changes to this policy

This policy may change as the service, providers, or law changes. The date above shows the latest revision. Material changes will be presented through the site or another reasonable channel before they take effect where required. Earlier processing remains governed by the policy and law applicable at that time.

14. Contact

For privacy questions, rights requests, or complaints, contact the crax-gpt operator through the crax-gpt Discord. Do not include passwords, full API keys, or other secrets in a public channel.