Documentation
Privacy notice
Read how request content, model answers, payment records, and public blockchain data are handled by the public service.
Privacy notice
Onchain Router processes request content to provide paid model responses, prevent abuse, recover a previous result without charging twice, settle payment, and operate the service. This notice describes the implemented technical behavior of the public service.
Request content
After payment verification and before calling the model provider, the service screens verified prompt text and stores an encrypted, redacted review copy for seven days. Detected credentials and obvious personal identifiers are removed before encryption. Authorized operators may review only one record at a time, and every access is recorded. The retention worker automatically deletes expired encrypted content.
When you select an automatic-routing alias, TypeSafe processes the supplied conversation and relevant tool/schema state to classify the request before payment. This classification is funded by Onchain Router and can occur even if you never pay or receive a completion. Automatic routing is experimental, currently limited to measured Gemini workloads, and can decline unsupported or uncertain requests. Choosing an explicit model skips TypeSafe classification.
The selected model provider processes request content to produce the response. Prompts and completions are excluded from application logs, metrics, alerts, receipts, and outbox payloads.
Operational records
The service retains the minimum payment, receipt, request-state, usage, security, and audit metadata needed for financial correctness, replay prevention, reconciliation, incident response, and legal obligations. Raw wallet signatures, complete payment payloads, receipt access tokens, wallet private keys, provider credentials, and cloud project identifiers are not placed in telemetry or receipts.
Completed responses are encrypted for short idempotent recovery: 15 minutes after successful release and up to one hour while settlement is ambiguous. This is separate from the seven-day prompt-review record.
Generated images are encrypted in a separate private-media store. Every image response includes url_retention_days: 7 and an exact url_expires_at timestamp. The capability URL stops serving the image at that timestamp. Azure lifecycle management permanently deletes the encrypted object after it becomes seven days old; physical deletion completes on Azure's next lifecycle scan. Buyers must download an image before expiration if they need to keep it longer.
Text-to-speech requests use ElevenLabs Zero Retention Mode. Speech-to-text is different: ElevenLabs receives the uploaded audio and transcript output in its standard retained mode and may retain both under the applicable agreement, account settings, and privacy policy. Onchain Router encrypts STT staging only after payment authorization and attempts to delete that local staging after every definite success or failure. After an ambiguous provider outcome, local staging becomes logically inaccessible at its one-hour expiry; encrypted bytes may remain beyond the one-day storage-lifecycle threshold until Azure completes its next lifecycle scan. Onchain Router's local deletion does not delete provider-held data.
Service providers and chains
TypeSafe supplies Jev request classification for automatic routing. Google processes text and image requests through Vertex AI. ElevenLabs processes text-to-speech and speech-to-text requests under the route-specific retention behavior above. Coinbase CDP verifies and settles x402 authorizations. Base records settlement transactions publicly. Azure hosts the application and operational data. Each service receives information required for its role and is governed by its own terms.
Public-chain notice
Wallet addresses, token transfers, transaction hashes, amounts, and block data written to Base are public and cannot be deleted by Onchain Router.
Data-use notice
Do not submit personal, confidential, regulated, or third-party content unless you have the right to process it through the named providers and public-chain payment flow. The service may change this notice as it evolves; the date below identifies the version that applies.
Last reviewed: 2026-09-04.