What we keep, and where our promise stops.
The short version
Off Record is a chat app. It sends your messages to AI models through AnonRouter and streams the answers back. The app itself stores no prompts, no replies, no files, no chat titles and no chat history. There is no database table they could go into.
That promise covers the part we run. Your message also passes through AnonRouter and through the provider running the model. Their handling is described below in their terms, not ours, and every answer in the app is labelled with the provider route that served it.
What this app keeps
| Item | Why | How long |
|---|---|---|
| Account fingerprint (HMAC-SHA256 of your email, keyed with a server secret) | To recognise you at sign-in without storing the address | Until you delete the account |
| Plan, account status, confirmation that you're 18+, terms version | To apply the right limits and record consent | Until you delete the account |
| Usage totals per day and per month: spend, number of requests, token counts | To enforce your spend and rate limits | Until you delete the account |
| Strike count: how many requests hit the hard limit (a number only) | Abuse control | Until you delete the account |
| Session token (hashed) in a cookie | To keep you signed in | Valid 30 days or until you sign out; deleted within a day after that |
| Sign-in codes (hashed), up to five live at once | Email sign-in | Valid 10 minutes, single use; deleted within a day after that |
| Rate-limit counters: a count per time window, keyed by hashes of your IP address (salted daily), your account and your email fingerprint. Message counters keep only the current minute and day. | To enforce message limits and slow down sign-in abuse | Deleted within 48 hours |
| A row for each answer while it is being written (amount held, expiry) | Concurrency and spend reservation | Deleted when the answer ends (at most about 5 minutes) |
What it never keeps
- Your prompts, the model's replies, or its reasoning text.
- Images and files you attach. They're read in your browser and sent with the message; the server never writes them anywhere.
- Chat titles, conversation history, or custom instructions.
- Your email address. It's used to send the code, then dropped.
- Your IP address in readable form.
- A log of your requests. A message that works writes no log line at all. A failure writes an event name and an error code: no model, no token counts, no cost, nothing you wrote. A test fails if the code tries to log anything else.
Your browser
The conversation lives in the page's memory. Close the tab, clear the chat, or sign out, and it's gone. If you turn on Remember chats on this device, chats and custom instructions are saved in this browser's local storage, on your device only. Turning it off deletes that copy. Your model choice and privacy settings are saved in the browser as preferences.
The page blocks remote images (so a model can't plant a tracking pixel in an answer), only talks to this app's own server, and sends no referrer when you click a link in an answer.
AnonRouter
We call AnonRouter with its private ticket flow. For each message our server asks AnonRouter's control plane for a single-use ticket. That request carries our account key and the model name, but not the message. The message then goes to AnonRouter's relay with only the ticket, so, per AnonRouter's documentation, the relay sees the text but not which account sent it, and nothing in either request says which Off Record user you are.
AnonRouter states that it doesn't write prompts or responses to disk, runs its relay in an attested confidential VM, and keeps operational records such as model, token counts, cost, status, latency and timestamps for billing. Those are their commitments; see docs.anonrouter.ai/privacy.
Model providers
Every provider route carries one label. The app shows it before you pick a model and stamps it on every answer.
| Label | What it means |
|---|---|
| Private | Prompt and response content isn't retained by the provider after the request completes. |
| TEE | Inference runs inside a hardware-isolated, attestable enclave. |
| Anonymous | Your identity is hidden, but the provider sees the text while serving it and may keep it under its own policy. |
Sign-in email
Sign-in codes are delivered by Resend. To send one, Resend receives your email address and the email itself (a six-digit code), and keeps delivery records under its own policy. Nothing else is sent to it: no messages, no usage, no account details. The subject line is a neutral “Your sign-in code”.
Hosting and logs
The app runs on Vercel. Like any web host, Vercel records that requests happened (time, path, status and network details such as the requesting IP) on its own retention schedule. Those records never contain message text, because the app never puts it in a log or a URL, and the app adds no line of its own for a message that works.
Deleting your account
Settings → Account → Delete account removes your fingerprint, plan, usage totals, strike count, sessions, sign-in codes and rate-limit counters immediately. If an answer is still being written, its held amount is added to the business-wide totals first. Those totals keep their numbers, which aren't linked to anyone. Billing metadata AnonRouter holds for our account isn't linked to you and isn't affected. A paused account can't delete itself; contact support.