# Privacy and your data

> BitsRun never logs or stores your prompts and outputs, never trains on them, keeps your data in the United States, and keeps only what it needs to bill you and protect your account.

Source: https://bitsrun.com/docs/account/privacy/
Updated: 2026-11-13

Your endpoints are private. The model runs for you alone, and what you send it stays between your app and the model.

This page is a plain summary. The full [Privacy Policy](https://bitsrun.com/privacy/) is the one that counts if the two ever differ.

## What we never keep

- **Prompts and outputs.** The text, images or documents you send and the answers you get are passed through and never written to our logs or databases.
- **Your API keys.** We store only a fingerprint of each key and its first few characters, so a key can be checked and recognised but never read back.
- **Remote control conversations.** Sessions between bitsrun and your phone or browser are end-to-end encrypted. Our relay passes them along without being able to read them. We see only who connected, when, and how much data passed.

We never use your data or your models to train anything. We do not sell your data, and we do not use it for advertising.

## What we keep, and why

| What | Why | How long |
|---|---|---|
| Your email address | To sign you in and send account emails | Until you delete your account |
| Your first and last name | To know who holds the account and address you | Until you delete your account |
| Your confirmation that you are 18 or older, and when you gave it | To show the account holder said they are an adult | Kept with your billing records |
| Your choice about product news emails, and when you made it | To send them only if you asked | Until you delete your account |
| Passkeys you add (only the public half ever reaches us) | To sign you in | Until you remove them or delete your account |
| Endpoints, settings and API key names | To run your endpoints | Until you delete them or your account. A deleted endpoint stays in your billing history, and a revoked API key's fingerprint is kept for 90 days |
| Request records: time, endpoint, which key, a scrambled form of the caller's IP address, and the caller's approximate location (country and state or province) and network | To answer "who used my endpoint", stop abuse and settle billing disputes | 180 days |
| Usage and billing records: running seconds, cost, top-ups, plan payments and refunds | To bill you correctly | As long as the law requires |
| Which version of the Terms and the Acceptable Use Policy you accepted, and when | To show what we both agreed to | Kept with your billing records |
| Your Hugging Face token, encrypted | To read the gated or private repos you deploy | Until you remove it |
| Models and adapters you upload or copy | To serve your endpoints | Until you delete them, or 7 days after your balance goes below $0 (see below) |
| From the iOS and Android apps: a push notification token and an installation ID for each phone or tablet | To send the notifications you turned on | Until you sign out of the app, remove the device or delete your account |
| Remote control: the names and public keys of the computers and devices you pair, and a record of which computer and device connected, and when. Never the conversation | To connect your devices and stop misuse | Session records: up to 24 hours after a session was last active. Pairing details: while the pairing exists; a device you revoke keeps a short entry so it stays blocked. All of it is erased when you delete your account |
| Emails you send to support, with their attachments and our replies | To answer you and follow up | 2 years |

The scrambled IP address can be matched against an address you give us, but cannot be read back.

**Stored models at a negative balance.** Storage is charged from your credit, so if your balance goes below $0 we email you on the first day with the date your stored models will be deleted, and remind you 2 days before it. If the balance is still below $0 after 7 days, we delete your stored models and the endpoints that use them, and email you to confirm. Adding credit that brings the balance back to $0 or more cancels this. See [Model storage](https://bitsrun.com/docs/billing/storage/).

## Where your data lives

Your account data, stored models and GPUs are in the United States. Payments are handled by Stripe; BitsRun never sees your card number.

## Who we share data with

Only the companies we need to run BitsRun, and only what each one needs:

- **Amazon Web Services** hosts BitsRun: the servers, storage, sign-in and email.
- **Stripe**, through its Link service, takes your payments and is the seller on your receipt. It handles your card and payment details under its own privacy policy.
- **Apple and Google** deliver push notifications to the iOS and Android apps. A notification holds a short message, such as an endpoint or computer name or your balance, and never a prompt or an answer.
- **Hugging Face and the Ollama registry** are contacted when you ask us to fetch a model from them. Your Hugging Face token goes only to Hugging Face.

We do not sell your data and we do not share it for advertising.

## How your models are kept separate

- Models you upload or copy are stored in your account and used only for your endpoints.
- BitsRun runs only model weights, in the `safetensors` and GGUF formats. It never runs code that comes with a model (such as `trust_remote_code`), so a model file cannot run programs.
- Each model runs separately from other customers' models.

## Your Hugging Face token

When you add a Hugging Face token for gated or private repos, we check it with Hugging Face, store it encrypted, and use it only to read and copy the repos you deploy. It is never shown again, even to you. Use a read-only token, and remove it any time:

```bash
bitsrun hf-token rm
```

## Your choices

- **Delete what you do not need:** endpoints, keys and uploads, from the dashboard or the command line.
- **Revoke access:** keys, command line sessions and remote control devices. See [Sessions and devices](https://bitsrun.com/docs/account/sessions-and-devices/).
- **Delete your account:** see [Delete your account](https://bitsrun.com/docs/account/delete-account/).
- **Ask for a copy, a correction or deletion:** you can delete your account yourself, or write to privacy@bitsrun.com or support@bitsrun.com from the email you sign in with. We answer within 30 days.