Docs · Privacy

Network privacy

Sevren does not provide network privacy. A network provider in front of the Sevren services terminates TLS: it sees your IP address and, in transit, the contents of requests and responses, prompts and completions included. Its logging is outside Sevren's control. If hiding your IP address matters to you, connect through network-level protection you trust.

The Sevren services never log IP addresses or prompts and remove client addresses before any request handler runs. The one use of an address is the daily pseudonym that counts free questions without an account.

The path of a request

Your client. The web app sets no cookies and runs no analytics of its own. Apart from the wallet connector on the sign-in and account pages, it loads no third-party scripts, fonts or images.
The network provider. It terminates TLS and passes the request on to Sevren. It sees your IP address and the request and response in transit.
Sevren. The Sevren services remove client address headers before any handler runs; only the model API first derives the keyed daily pseudonym that counts free questions. The model API handles prompts and completions in memory only and refuses to start if body logging is switched on. Logs contain errors only, never bodies, keys, IP addresses, wallet addresses, payment references or transaction hashes. Request-body debug capture is disabled, including for requests answered with an error.
The model. Models served through an upstream inference provider are processed there: it receives the messages, tool definitions and sampling settings of every request to those models, and what it logs or keeps is outside Sevren's control. It never receives your IP address, request headers, key, session or account.

Paid model requests use account credit with your session token. Free models use the shared daily question allowance without deducting credit. The payment watcher that turns payments into credit never receives prompts.

Accounts

An account is an Ethereum wallet: you sign in by signing a message with it, which costs no gas. There is no username or password, and no email address, phone number or name is ever asked for. Wallet sign-in and token-gated models show your wallet address to the Sevren auth service, which keeps the address of a signed-in wallet encrypted to refresh holder plans; the model API and the account service see only a keyed pseudonym of it. Adding credit needs an account, because a payment is credited through the account's payment reference. Without an account, the web terminal offers only the free questions.

The wallet connector

The sign-in and account pages load Privy's wallet connector, which lists wallets and connects the one you pick, to sign in or to pay. Sevren uses it only to connect a wallet: there is no Privy login, no Privy account and no wallet created by Privy.

While one of these pages is open, your browser contacts Privy (auth.privy.io) to load the connector's settings, and the connector reports its own usage events to Privy.
A mobile wallet or a QR code connects through WalletConnect's servers, and Coinbase Wallet through Coinbase's relay. Paying from a mobile or QR wallet also sends the page's chain reads to Robinhood Chain's public RPC (below).
These services see your IP address and browser details, and may see the address of the wallet you connect. What they log or keep is outside Sevren's control.
Other pages, such as the terminal, the models and these docs, do not load the connector.
Sevren's servers receive nothing from Privy or WalletConnect. Your wallet signs the sign-in message, and the Sevren auth service verifies the signature itself.

Payments

Credit is added with a direct payment of ETH or USDG to the Sevren payment contract on Robinhood Chain. The payment carries your account's payment reference, and its full value becomes credit after 900 block confirmations, usually 1 to 2 minutes later. Payments are final: they cannot be withdrawn or refunded.

Public. A payment is an ordinary public transaction. Anyone can see the paying wallet, the asset and amount, the time and the payment reference.
Linked to your account. Your reference never changes, so anyone can group all of your account's payments, and the wallets that made them, without knowing which account it is. Sevren links each payment to the account it credits by its reference, and the transaction hash it keeps leads to the paying wallet on any explorer.
Your wallet's RPC provider sees the price and allowance reads and the payment itself, together with whatever it knows about you. With a mobile or QR wallet, the page sends these reads, and for USDG the checks for the approval's receipt, from your browser to Robinhood Chain's public RPC (rpc.mainnet.chain.robinhood.com) instead. That RPC sees your IP address with them, and the allowance read contains your wallet address.
Never revealed by a payment: your prompts and completions, and which models you used or when. The reference is random and carries no account id or name.

If you do not want your account tied to your on-chain identity, sign in with and pay from wallets that have no link to you. Payments explains the contract and the flow.

What Sevren stores

Data Sevren stores
Data	Details	Kept
Account	A keyed pseudonym of the account's wallet (never the address), the plan and holding share with their check time, and the account's payment reference.	Until the account is deleted
Sessions	A hash of each session token, never the token itself.	14 days
Credit	Balance, credit history and usage totals per day and model: request count, tokens and cost. There are no per-request records.	Until the account is deleted; daily totals indefinitely
Payments	Per payment: the transaction hash, block, reference, credited account, asset, amount, the ETH/USD price used and the credited USD. No payer address, although the transaction hash leads to it on any explorer.	Indefinitely, as the payment ledger; kept without the account link when the account is deleted
Wallet address	Stored by the auth service, encrypted, to refresh holder plans. The account service never receives it. No paying wallet's address is stored.	Deleted after 90 days without a sign-in or plan refresh
Free tokens	The free-try tokens each wallet has used per model, and the holder plan tokens it has used per UTC day and model, prompt and output, under the same keyed pseudonym of the wallet (never the address).	Free try: kept after the account is deleted, so it stays once per wallet. Plan tokens: two days after the day ends
Rate limit counters	Counters per model or account, in memory without persistence.	Seconds to an hour
Free question counters	Guests: a count under a keyed daily pseudonym of the IP address. Signed-in users: a count under a keyed account identifier. Both use one service-wide cap in memory-only storage. No raw address or prompt is kept.	Until the UTC day ends

Free questions without an account

The free models share a daily allowance: 7 questions for guests, or 25 after wallet sign-in, without deducting credit. Guest questions use a keyed daily pseudonym of your IP address; signed-in questions use a keyed account identifier shared across your sessions. These counters live in memory-only storage and reset at 00:00 UTC. The address itself and your prompts are never stored in these counters.

A counter expires when its UTC day ends, and is lost when the storage restarts. It holds only the number of questions, with no content and no time finer than the day.
It is a pseudonym, not anonymization: whoever holds the key, the Sevren operator or anyone who takes over the service, could find the address behind a counter by trying every possible address for that day.
Guests behind the same IP address, such as an office or a mobile carrier, share an allowance. Signed-in accounts use their wallet account allowance across sessions.
Free questions follow the same model path as paid requests; their prompts and completions are not retained.

Requests answered with 400

Request-body debug capture is disabled. Requests answered with HTTP 400 are not retained, and neither are their prompts, model responses or error bodies.

A 400 is not always a mistake in your client: a conversation that no longer fits the model's context window also answers 400. Every response carries an X-Request-Id header; quote it when you report a problem.

What Sevren never stores

Prompts, completions and request bodies, including requests answered with an error.
Client IP addresses.
The address of a wallet that pays.
Usernames, passwords, email addresses, phone numbers or names: none are ever asked for.
Cookies or analytics of its own. Apart from the wallet connector on the sign-in and account pages, the web app loads no third-party scripts, fonts or images.

What is not promised

Payment privacy. Payments are public and linked to your account by its reference (above).
Privacy from the wallet connector. Privy, and WalletConnect when you use it, see your IP address on the sign-in and account pages and may see your wallet address (above).
Network anonymity. The network provider sees your IP address and your traffic in transit. Request sizes and streaming timing are visible to the operator.
Prompts that never leave Sevren servers. Models served through an upstream inference provider are processed there.
Protection from the operator. One operator runs every Sevren service, the database and the hosts. Keeping them apart limits what one compromised service can read; it is not cryptographic protection against the operator.

What this browser keeps

The terminal saves its current conversation in this browser's localStorage by default, including prompts, responses and model reasoning, so it survives a refresh. This copy is not encrypted or synced to an account or server; anyone using this browser can read it. Use Clear history to remove it, or turn off Keep history in this browser to remove the saved copy and keep the open conversation in memory only. With saving off, leaving the terminal or refreshing clears the conversation. Standalone mode sends only your current message to the model; it does not switch off browser storage.

Your session token stays in this tab's session storage while Stay signed in on this tab is on, which is the default; turn it off on the sign-in page to keep the token in memory only. Chat history contains no automatically added session tokens or wallet secrets. No prompts go into cookies, URLs or analytics. Payments you send are tracked in memory only while the account page waits for them to be credited; nothing about them is saved in this browser.

The wallet connector keeps its own data in this browser's storage for this site: the wallets you connected, with their addresses, and an identifier it sends to Privy. WalletConnect and Coinbase Wallet keep their connection data there when you use them. Clearing site data in browser settings removes it.

On your side

Keep session tokens in environment variables or a secret store. Never put them in URLs, source code or client-side code.
Your own client logs, proxies and SDK telemetry are outside Sevren's control. Check what they record before sending sensitive prompts.
Conversations can identify you. Prefer standalone mode, and on a shared device turn off browser history or clear it when you finish. Clearing site data in browser settings also removes local history.

Read the terms of use for the rules that apply to the service.

> open terminal