Privacy

There is no account

The gateway has no sign-up, no email, no password and no API key. Calls are paid per request over x402 and authenticated by the payment itself, so the only identifier attached to a call is the wallet address that paid it. We never ask for your name and have no way to connect one to a wallet unless you tell us.

chat.openzoo.fun is different. It runs a hosted chat app that keeps an account so conversations persist. The account is created by signing a fixed message with your wallet — no password exists — and your history is stored on our database until deleted. You can export all of it as a zip from the wallet panel at any time, and that export is everything we hold for that account.

On-chain payments are permanent and public

Every paid call settles as a real transaction on Solana, Base or Robinhood Chain. The paying address, the amount and the timestamp are written to a public blockchain by design. We cannot delete, redact or amend that, and neither can you. Anyone can read it, forever.

This is the tradeoff that makes an account unnecessary, and it is worth understanding before you send anything. If you would rather your spending not be publicly linkable to you, use a fresh wallet.

What we store when you bind a corpus

Binding sends your text to our memory service so later questions retrieve relevant passages instead of resending the whole body. That text is stored on our infrastructure until it is deleted.

• —Signed namespaces are isolated. When a bind is signed by a wallet, the corpus lands in a space only that wallet can read. A request without the signature gets a 404 even holding the exact context id.
• —Unsigned binds share one space. Binding without a signed namespace — which includes the free demo tier and the plugin's shared mode — puts your corpus in a common tenant, where anyone holding the context id can read it. That id is a random 26-character string, so it is not guessable in practice, but it is the only thing protecting the text. Treat an unsigned bind as public: no credentials, no keys, and nobody else's personal information.
• —You can delete a corpus. The zoo_forget tool and the /v1/hrr/ablate endpoint remove a bound context. Deletion is scoped to the tenant that wrote it, so a corpus bound with a wallet must be deleted with that same wallet.

Your prompts go to model providers

openzoo does not train models and does not own most of the ones it serves. When you ask a question, the prompt — and the retrieved slice of any bound corpus — is forwarded to the upstream provider running the model you chose. That provider sees it, and their privacy policy governs what they do with it, not ours. Which provider depends entirely on the model id you pick.

If a prompt should not leave your machine, do not send it to a hosted model. The local proxy and the plugin's bundled memory daemon exist for that case: binding and retrieval stay on your own computer, and only an actual model call ever leaves it.

What our logs contain

We keep operational logs to run the service and reconcile payments. They record:

• —the endpoint called, a timestamp, the HTTP status and the size of the body
• —the model requested and token counts, so a call can be priced and reconciled
• —a truncated IP address — an IPv4 loses its final octet, an IPv6 keeps only its first three groups
• —a truncated payer address, the first eight characters, which is enough to count distinct payers and not enough to identify one

We do not log prompt or response bodies. Truncation happens before anything is written, so the full values are not stored somewhere else — they are not stored at all.

No tracking on this site

openzoo.fun runs no analytics, no advertising pixels, no session recording and no third-party tracking of any kind, and sets no cookies. There is nothing to opt out of because there is nothing collecting. The hosted chat app has its own product telemetry switched off at the environment level.

Pages that read blockchain data query public RPC endpoints from your browser. Those providers see your IP the same way any site you visit does.

Getting your data out, and getting it deleted

• —Export — the wallet panel on chat.openzoo.fun exports every conversation as a zip, both as readable markdown and as the raw JSON.
• —Delete a corpus — zoo_forget or /v1/hrr/ablate, from the wallet that bound it.
• —Delete a chat account — ask us and we will remove it and its conversations.
• —What cannot be deleted — on-chain settlements, for the reason above. They are not ours to remove.

Children

This service is not directed at children and is not intended for anyone under 13, or under the age of digital consent where they live.

Changes

If this policy changes in a way that affects what we collect or who sees it, the date at the top changes with it. We do not have your email, so we cannot notify you directly — a consequence of not collecting one.

Contact

Questions, deletion requests, or anything you think this page gets wrong: @STACCoverflow on X.