Privacy Policy
This policy explains what Cylink — the API built and run by CyanixLabs — collects when you use the console and API at cylinkdev.vercel.app, why we collect it, who we share it with, and what you can ask us to do about it.
The short version. We collect what we need to run an API gateway: your account identity, your API keys, and a record of every request that passes through — timing, routing, tokens and cost. We log prompts and responses so traces and debugging work.
We do not sell your personal information, and we do not use your prompts or outputs to train models.
01 Who we are
CyanixLabs ("we", "us") makes and operates Cylink, the developer API gateway and console. For the personal information described here, we are the controller — or, in U.S. state privacy terms, the business — unless you use Cylink to process personal information on behalf of your own users, in which case you are the controller and we act as your processor / service provider for that data.
Reach us at nixai.cy@gmail.com — that inbox handles privacy, security and legal questions alike.
02 What we collect
Account information
When you sign up we collect your email address and, depending on how you sign in, an authentication credential: a hashed password, a one-time sign-in link token, or an OAuth identifier from GitHub or Devit. Signing in with GitHub or Devit shares with us the basic profile that provider releases — typically your identifier, email address, username and avatar URL. We do not receive your password for those services.
API keys
We store your API keys in hashed form together with a short non-secret preview (for example cyk_••••4f2a), the key's name, when it was created, when it was last used, and whether it has been revoked. The full key exists in plaintext only in the response that created it, which is why we show it once and never again.
Requests through the API
Every call generates a record. This is the core of what the console shows you:
| Record | Contains |
|---|---|
| Requests | Request ID, timestamp, endpoint, model, key used, status code, latency, and the prompt or input payload you sent |
| Responses | The output returned, token counts, and computed cost |
| Routing decisions | Which route the orchestrator chose and why, plus the alternatives it considered |
| Trace events | Per-stage timings across the ARI, Axion, tool and Cylink stages of the pipeline |
| Usage | Aggregate request counts, cost and rate-limit consumption per key and per billing cycle |
Assume anything you put in a prompt is stored. Do not send secrets, credentials, health records, government identifiers, payment card numbers or other sensitive personal information through the Playground or API unless you have agreed a specific arrangement with us in writing.
Billing information
Your plan, billing cycle, plan changes and invoice history. Card details are collected and stored by our payment processor, not by us; we receive only a token, the card brand and last four digits, and the outcome of each charge.
Technical and device data
IP address, user agent, approximate region derived from IP, timestamps, referring pages, error reports and security events such as failed sign-ins. This is standard server and edge logging and is also how we detect abuse.
Support and correspondence
If you email us or contact sales, we keep the message and our reply.
Browser storage
Cylink uses your browser's local storage for your authentication session (the sb-*-auth-token entry) and for preferences such as your theme choice (cylink.theme). These stay on your device. We do not use third-party advertising or cross-site tracking cookies.
03 Why we use it
| Purpose | Data used | Legal basis (EEA/UK) |
|---|---|---|
| Provide the service | Account, keys, requests, responses | Contract |
| Show analytics and traces | Requests, traces, routing, usage | Contract |
| Meter and bill | Usage, plan, billing records | Contract |
| Enforce limits and prevent abuse | Requests, IP, security events | Legitimate interests |
| Debug and improve reliability | Logs, errors, aggregate usage | Legitimate interests |
| Security and incident response | Logs, IP, account activity | Legitimate interests / legal obligation |
| Service and billing emails | Email address | Contract |
| Product and marketing emails | Email address | Consent (withdrawable) |
| Meet legal and tax obligations | Billing, account records | Legal obligation |
We do not use your prompts, files or model outputs to train or fine-tune models, and we do not sell personal information or share it for cross-context behavioural advertising. Human review of the content of your requests happens only when you ask us to look at something in support, when we must investigate abuse or a security incident, or when the law requires it.
05 How long we keep it
| Data | Retention |
|---|---|
| Account & profile | While your account is open, then deleted within 30 days of closure |
| API key records | While active; revoked keys retained up to 12 months for audit |
| Request & response payloads | Up to 30 days on Free, up to 90 days on paid plans, then deleted |
| Traces & routing decisions | Same window as the request they belong to |
| Aggregate usage & analytics | Up to 24 months, in a form not tied to prompt content |
| Billing & tax records | Up to 7 years, as required by law |
| Security & abuse logs | Up to 12 months, longer if part of an open investigation |
Backups are purged on their own rolling schedule, so deleted data can persist in backup for a short additional period. Enterprise customers may agree different retention in their order form.
06 Security
We encrypt data in transit with TLS and at rest, hash passwords and API keys, keep privileged operations such as key creation and revocation behind server-side functions so no privileged credential ever reaches your browser, restrict internal access to the people who need it, and log administrative activity.
No system is perfectly secure, and during beta you should treat Cylink accordingly. If you discover a vulnerability, report it to nixai.cy@gmail.com rather than disclosing it publicly; we will not pursue good-faith research that respects our customers' data. If a breach affects your personal information, we will notify you and any regulator as required by law.
07 Your rights
Depending on where you live, you may have the right to:
- Know and access the personal information we hold about you and how we use it;
- Correct information that is inaccurate;
- Delete your information, subject to records we must keep;
- Port a copy in a portable format;
- Opt out of sale or sharing for targeted advertising — we do neither, so there is nothing to opt out of;
- Limit use of sensitive personal information — we do not use it for inferring characteristics;
- Object to or restrict processing based on legitimate interests, and withdraw consent you have given;
- Be free from retaliation for exercising any of these rights.
Much of this you can do yourself in the console: view and delete keys, export usage, update your email, and delete your account. For anything else, email nixai.cy@gmail.com. We will verify your request against your account and respond within the time the applicable law allows — generally 45 days under U.S. state law and one month under GDPR. An authorised agent may submit a request on your behalf with proof of authorisation.
If you are unhappy with our response, you may complain to your state attorney general, or to your data protection authority in the EEA or UK.
08 International transfers
CyanixLabs operates Cylink from the United States and our infrastructure runs primarily in U.S. regions, including us-east-1. If you use the service from outside the United States, your information is transferred to and processed there, under laws that may differ from your own. Where we transfer personal information out of the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) together with additional safeguards.
09 Children
Cylink is a developer tool for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to nixai.cy@gmail.com and we will delete it.
10 Automated decisions and tracking signals
We apply automated rate limiting, quota enforcement and abuse detection, which can slow or block requests and, in serious cases, suspend an account. These decisions are reviewable by a person — contact us and we will look at it. We do not use your data for profiling that produces legal or similarly significant effects on you.
We honour Global Privacy Control and similar browser opt-out signals where the law requires, though since we do not sell or share personal information for advertising, such a signal does not change how we handle your data.
11 Changes to this policy
We will update this policy as the product changes. The effective date at the top always reflects the current version, and for material changes we will give notice in the console or by email before they take effect. Continuing to use Cylink afterwards means you accept the updated policy.
12 Contact
Privacy questions, rights requests, security reports and complaints all go to the same inbox at CyanixLabs. Put the type of request in the subject line so we can prioritise it.