Privacy policy

1. Who controls your data

Qwen3.8 Playground is operated by Shinstar LLC, which is the data controller for the account, API, and billing data described in this policy. Privacy requests may be sent to contact@qwen3-8.org.

2. Data we receive

• Account email, verification time, and account identifier when you request and use a one-time sign-in code.
• Google account subject identifier, verified email, and hosted domain status when you choose Google OAuth or One Tap. We use the subject identifier, not the email address, as the durable Google identity key.
• Hashed session and API-key values, key prefixes, plan state, call counts, token counts, and provider request identifiers.
• Yito Pay order identifiers, selected plan, entitlement state, and signed billing events. We do not receive or store full card numbers.
• Basic request logs such as time, route, status, Cloudflare request ID, and operational error codes.
• Page and conversion analytics collected through Google Analytics 4 and click.pageview.click, subject to their technologies and your browser choices.

3. Prompt content

The first-party API forwards request content to OpenRouter and its selected upstream model provider to produce a response. We do not write prompts or completions to our D1 application database. Infrastructure or upstream providers may process or retain data under their own policies. Do not send secrets, regulated data, or personal data you are not authorized to process.

4. Third-party demo

The homepage frame loads directly from a community Hugging Face Space. Prompts entered there go to that Space, not to our Worker or D1 database. Hugging Face and the Space operator control its availability and data practices. Use the external-link control to inspect the host before submitting sensitive content.

5. Why we use data

We use data to authenticate accounts, issue and revoke keys, enforce quotas and rate limits, settle entitlements, prevent abuse, send transactional email, diagnose errors, and understand the conversion funnel. We do not sell personal data.

6. Service providers

Cloudflare hosts the Worker and D1 database. ZeptoMail delivers sign-in and operational email. pay.yito.ai and Stripe support checkout and billing. OpenRouter provides model routing. Hugging Face hosts the independent demo. Google Identity Services provides optional Google sign-in, while Google Analytics 4 and click.pageview.click provide traffic analytics. Each provider acts under its own terms and privacy practices.

7. Retention and security

One-time sign-in codes expire after 10 minutes and allow no more than five attempts. Sessions expire after 30 days, and expired authentication and rate-limit rows are cleaned on a schedule. Google OAuth state and nonce values are one-time and expire after 10 minutes. Account, entitlement, usage, billing-reference, and security records are retained as needed to operate the service, resolve disputes, prevent fraud, and meet legal obligations. Sign-in codes, session tokens, API keys, OAuth state, and OAuth nonce values are stored only as keyed hashes or hashes; service secrets are encrypted Worker secrets.

8. Your choices

You may revoke API keys, cancel future subscription renewals through the billing portal, block analytics with browser controls, or request access, correction, or deletion by emailing contact@qwen3-8.org. Some billing and security records may need to be retained after account deletion.

9. Changes

Material changes will be reflected by a new effective date on this page. Continued use after a change means the updated policy applies to future activity.