Privacy policy

What we collect

• Account: your wallet address, the hashes of your API keys, your balance and your deposit transactions.
• Requests: for each request, the key id, model, upstream, token counts, latency, list cost, market cost, discount and charge.
• Website: standard server logs (IP address, user agent) kept for security for up to 14 days. No advertising trackers.

What we don’t collect

• Prompt and completion content. It streams through to the upstream that serves the model and back, and is never written to our logs or database.
• Private keys or seed phrases. Signing in is a signed message.
• Seller provider keys, which go directly to the marketplace, encrypted.

Who sees your requests

The upstream that serves a request (a marketplace seller’s provider, or OpenRouter) processes its content under its own privacy policy. Choose models accordingly for sensitive data.

Your choices

You can revoke keys at any time. To delete your account metadata, contact us on X at @getmercato with a message signed by your wallet. On-chain transactions are public and cannot be deleted.

We don’t sell data

We never sell or rent personal data.