APIRouterAIPrivacy policy
What APIRouterAI collects, who can see it, and how long it is kept.
1. Who we are
Garg Capital Group LLC ("we", "us", "our") operates APIRouterAI. For most data in the service — especially prompts and replies — we act on behalf of the organization you belong to, which decides how the service is configured. Your organization's admins can answer questions about how they use it.
2. What we collect
Account details: your email address, your name if you give one, your organization, your role, and whether your access is active or suspended.
Sign-in data: one-time sign-in codes (stored hashed and valid for a short time), session tokens, and the API keys created for your devices (stored hashed). Your IP address is used briefly to rate-limit sign-in attempts.
Request logs: when you use an AI tool through APIRouterAI, we record details of each request — the time, which tool sent it (taken from its user agent), the model tier asked for and the model that answered, the models tried along the way and why any failed, status, latency, token counts, and the name of your device. Depending on your organization's logging setting we also store the text you typed and the AI's reply (the default), the full request and response ("full"), or no content at all ("off"). Calls a tool makes on its own, such as generating a title, are recorded and marked as background.
Organization configuration: provider API keys and credentials your admins add (encrypted with AES-256-GCM), model order, usage limits, custom providers and invitations (invitee email and role).
Device data: a device identifier and label, the platform, and which AI tools and local models are available on a connected Mac, so the service can route requests.
We do not use advertising trackers or analytics SDKs, and we do not collect your location, contacts or payment card details.
3. Who can see your prompts and replies
Admins of your organization can read request logs of members with the user role and their own; super admins can read every member's. You can see your own history in the app. Our staff access logs only when needed to operate, secure or support the service, or when the law requires it.
4. How we use data
To sign you in, to route each request to the AI provider and model your organization configured, to fall back to another model when one is unavailable, to enforce usage limits, to show logs and usage to the people allowed to see them, to send sign-in codes and invitations, and to keep the service secure and working.
We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use your prompts or replies to train AI models.
5. Who we share data with
AI model providers your organization configures — for example Anthropic, OpenAI, OpenRouter, Groq or a custom provider — receive the content of your requests in order to answer them, under their own terms and privacy policies.
Service providers that run APIRouterAI for us: Render (application hosting), Neon (database hosting), Resend (email delivery of sign-in codes and invitations) and GitHub (hosting of app downloads). They process data only to provide their services to us.
We may disclose data if the law requires it, to protect people's safety or our rights, or as part of a merger or acquisition, in which case this policy continues to apply.
6. What stays on your Mac
The desktop app stores your sign-in in the macOS keychain. The command-line tool keeps its configuration, its device key and local logs in the .apirouterai folder in your home folder. If a request fails to reach our servers, the tool may hold a copy of the request log on disk until it can deliver it.
7. How long we keep data
Request logs are deleted after the retention period your organization sets (30 days by default; an organization can choose up to ten years or to keep them indefinitely).
If you delete your account, we delete your account, sessions and keys; request logs you made stay with the organization until its retention period removes them, with your identity detached. If a super admin deletes the organization, its keys, settings, logs and invitations are deleted. Backups held by our database provider expire on their own schedule.
8. Security
Traffic to the service is encrypted with TLS. Provider credentials are encrypted at rest, and sign-in codes and API keys are stored as hashes. No system is perfectly secure; tell us at once if you believe your account has been compromised.
9. Your rights
Depending on where you live (including under the GDPR and the California Consumer Privacy Act), you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to complain to a data protection authority. To delete your account or make any other request, email login@voyaone.ai; where your organization controls the data, we may refer you to it. We will not discriminate against you for exercising these rights.
Data is processed in the United States and other countries where our service providers operate.
10. Children
APIRouterAI is a workplace tool and is not directed at anyone under 16. We do not knowingly collect data from them.
11. Changes and contact
We will update this policy when the service changes how it handles data, and change the effective date at the top. Material changes will be announced to organization admins before they take effect.
Questions or requests: login@voyaone.ai. Garg Capital Group LLC.