Privacy Policy
Last updated: 2026-09-24
◆ Executive Summary
SeedInfer operates on a strict Zero-Data Logging architecture. We do not store, log, or retain your prompts, completions, or any inference request payloads. All inference processing occurs in volatile GPU memory (VRAM/RAM). The only exception is the in-memory prefix (KV) cache, which may keep attention state for up to 60 s (max 5 min) so repeated prompt prefixes are billed as free cached input; it is never written to disk.
We collect only aggregated, anonymized traffic statistics (median latency, request volume, geographic distribution, token throughput) for network routing optimization and capacity planning. No request content is ever persisted to disk.
■ Data We Do NOT Collect or Store
✕ Prompts & User Inputs
Never written to disk. Processed in VRAM only. Prompt-prefix KV cache blocks may be reused in memory for up to 60 s (max 5 min) and are then evicted.
✕ Model Completions & Outputs
Streamed directly to client via SSE. No server-side buffering or storage. Zero retention.
✕ Conversation History / Context
No conversation state stored. Each request is stateless. Context window managed client-side or passed per-request.
✕ Personal Identifiers (Email, IP, Wallet Address linked to requests)
API keys are authenticated but not linked to request payloads in any persistent store. Routing layer sees only encrypted traffic metadata.
✕ Training Data / Model Fine-tuning
We do not use your prompts or completions for model training, fine-tuning, RLHF, or any ML pipeline. Your data never enters any training dataset.
■ Aggregated Traffic Statistics (Anonymous)
The following metrics are collected without any request content, user identifiers, or payload data:
Latency Metrics
- Median Time to First Token (TTFT)
- Median and tail latency percentiles
- Inter-token latency distribution
Throughput Metrics
- Tokens per second (aggregate)
- Concurrent request count
- Queue depth per node
Geographic / Network
- Client region (coarse, via routing layer)
- Node region (for proximity routing)
- Network path characteristics
Error & Health
- Error rates by type (timeout, OOM, network)
- Node uptime / availability
- Hardware health signals (temp, utilization)
■ Prompt & Completion Handling — Technical Deep Dive
Request Lifecycle
- Ingress: Request hits SeedInfer gateway (Orange Pi 4 Pro routing layer) via HTTPS/TLS.
- Routing: EWMA algorithm selects optimal provider node based on real-time latency/throughput. No payload inspection.
- Forward: Request forwarded via encrypted WireGuard (Tailscale) tunnel to provider node.
- Inference: vLLM engine loads prompt into GPU VRAM. KV cache allocated in VRAM (FP8 via
--kv-cache-dtype fp8). - Generation: Tokens streamed back via SSE through same encrypted tunnel.
- Cleanup: Immediately after stream ends, the request's KV cache is released; shared prefix blocks may stay in the in-memory prefix cache for up to 60 s (max 5 min). No disk write occurs.
VRAM Cache Behavior (KV cache)
The vLLM KV cache resides exclusively in GPU VRAM. It functions as a transient compute buffer, not persistent storage. Cache entries are:
- Allocated per request; blocks for shared prompt prefixes may be kept in the prefix cache
- Prefix-cache blocks expire after 60 s (max 5 min); all other blocks are freed on request completion or client disconnect
- Never serialized to disk, never checkpointed, never backed up
- Subject to GPU memory pressure eviction (LRU) automatically by vLLM
Retention duration: the duration of the inference request, plus at most 60 s (max 5 min) for reusable prompt prefixes. Nothing persists beyond that.
■ OpenRouter Compatibility
SeedInfer is fully compatible with OpenRouter's privacy model. When requests are routed via OpenRouter:
- OpenRouter acts as the data controller for requests originating from their platform
- SeedInfer receives only the forwarded request payload — no additional user context
- Our zero-logging guarantee applies identically: no prompt/completion storage on our infrastructure
- Aggregated routing metrics (latency, throughput) are shared with OpenRouter for their routing optimization, without any payload content
If OpenRouter has specific data processing agreements or retention requirements, those govern the OpenRouter → client relationship. SeedInfer's infrastructure adds no additional retention.
■ Provider Node Isolation
Provider nodes (NVIDIA GPUs with at least 32GB VRAM) run the vLLM engine in isolated Docker containers with:
- No persistent volumes mounted for inference workloads
- Read-only root filesystem for container (except /tmp for transient cache)
- Hardware fingerprint lock (SHA-256) binding identity to physical GPU/CPU — prevents container cloning
- Ed25519 keypair for node authentication — private key never leaves node, stored at
/etc/seedinfer/identity.key(0600 perms) - Outbound-only networking via Tailscale — no inbound ports, no public IP required
Provider operators cannot access request payloads, prompts, or completions. The container processes inference only.
■ Data Retention Summary
| Data Category | Retention | Storage Location | Purpose |
|---|---|---|---|
| Prompts / Inputs | Zero (VRAM only) | GPU VRAM (volatile) | Inference compute |
| Completions / Outputs | Zero (streamed) | Network buffer → Client | Delivery |
| KV Cache | Request duration (prefix cache ≤ 60 s (max 5 min)) | GPU VRAM (FP8) | Attention computation |
| Aggregated Latency Metrics | Rolling 30-day window | Time-series DB (aggregated) | EWMA routing optimization |
| Aggregated Throughput | Rolling 30-day window | Time-series DB (aggregated) | Capacity planning |
| Node Health / Hardware | Rolling 90-day window | Time-series DB | Fleet management, payouts |
| Provider Identity (PubKey) | Duration of node registration | Registry (encrypted) | Authentication, payouts |
| Client API Key (hashed) | Duration of key validity | Auth DB (bcrypt) | Authentication, billing |
■ Account Data We Store
If you create an account, we store only what is needed to sign you in and bill you:
- Profile: email address, whether it is verified, optional display name and avatar URL, sign-up and last sign-in time.
- Sign-in methods: a bcrypt hash of your password (never the password itself) and, if you use Google or GitHub, the provider's account ID, email and username. We request only basic profile and email scopes and do not keep provider access tokens.
- Sessions: creation/expiry time, sign-in method and browser user-agent of each active session, so you can review and revoke them.
- Billing: credit balance, invoices (chain, token, amount, transaction hash, status) and per-request usage (model, token counts, cost). Prompts and completions are never stored.
- Provider data (only if you run nodes): node tokens (stored only as SHA-256 hashes, plus name, prefix and creation/last-use/revocation timestamps — never the token itself), node-to-account bindings (node id, bound token, binding and last-seen times), your payout wallet address (USDC on Base) and the security log of payout-wallet and token changes.
Data is kept in a SQLite database on our own server, readable only by the service account, with rotating backups kept for up to 7 days. It is not sold or shared, except with the OAuth provider you choose during sign-in.
■ Your Rights
- Access & portability: download everything stored about your account as JSON in Settings → Your data — including node tokens (metadata only), node bindings, your payout wallet and the security log.
- Rectification: change your display name, password and linked Google/GitHub accounts in Settings.
- Deletion: delete your account in Settings — your profile, sign-in methods, sessions, credits and invoices are removed immediately, together with your node tokens, node bindings, payout wallet and security log; usage records are kept only in anonymized form. Copies in backups expire within 7 days.
- Session control: review active sessions and sign out of all other devices in Settings.
- Objection: you may opt out of aggregated metrics collection by contacting us (may degrade routing quality).
Contact
Questions about this policy or data practices: [email protected]
For provider-specific inquiries: [email protected]