Privacy by architecture, not policy. The whole design is on this page — three promises, the data flow, the persistence list, third parties, where the bits actually live, how to verify.
These same sentences appear in the landing FAQ, the CLI help text, and the support playbook. One wording, no remix.
One extra hop between your terminal and Anthropic. Inside that hop, request and response bodies are in memory only — never written to disk, a log aggregator, or an analytics pipeline.
Request and response bodies are never written to disk, log aggregator, or analytics pipeline anywhere in this path. What UAN persists is listed in full below — counters that support billing, reconciliation, and upstream debugging. Nothing more.
Every row shows what we store, why we need it, how long it stays, and how it leaves. The 13-month baseline covers a full billing year plus one month of reconciliation slack. Legal-retention rows sit longer because tax and anti-money-laundering rules require it.
| What | Why | How long | How to delete |
|---|---|---|---|
| Your account (GitHub ID, email) | Account system | Until you delete account | Dashboard → Settings → Danger zone |
| Key metadata | Key management | 13 months after revoke | Automatic |
| Request metadata (token count, timestamp, error code) | Billing, reconciliation | 13 months | Automatic |
| Wallet ledger entries | Tax + reconciliation | 24 months (legal minimum) | Automatic archive |
| BYO OAuth tokens | Required to proxy your requests | Until you revoke | Immediate on revoke |
| Payment metadata | Refunds, tax | 7 years (legal minimum) | Automatic |
Not stored because no code path on UAN's servers reaches for it in the first place. The architectural cost of adding any of these rows is a schema change, a privacy-doc rewrite, and a 30-day advance-notice email — by design.
“We do not persist request or response content” is honest. It is also narrow. Three paths do touch content for a specific reason — each with explicit limits. All three are here.
UAN shares the minimum data each party needs. Each row spells out what they get, what they do not, and which contract governs it.
| Third party | What we give | What we don't | Legal doc |
|---|---|---|---|
| Anthropic | Request body + response body, forwarded untouched. UAN's own billing account. | Your identity, email, IP, GitHub username. | Anthropic Terms + UAN zero-retention API clause |
| Stripe | Your email, recharge amount, card metadata (received by Stripe directly). | Request content, key list, BYO credentials. | Stripe DPA |
| Alipay / USDT on-chain | Recharge amount, on-chain address or Alipay ID. | Any other user data. | Channel ToS |
| AWS | Infrastructure-layer storage for the rows listed above. | Nothing outside the persistence list. | AWS DPA |
| KYC vendor (providers only) | Provider identity documents for payout compliance. | Anything from regular users. | Vendor DPA |
| Your OS keychain | Local OAuth and key storage on your own machine. | UAN server does not read it. | System API |
UAN does not use Google Analytics, Segment, Mixpanel, Amplitude, or any other third-party behavioural analytics tool.
UAN does not share user content with DeepSeek, Kimi, or any downstream model company.
UAN does not sell, trade, or exchange data with any data broker.
Most UAN users are cross-border developers who want low-latency access and a guarantee their code is not read. A hard geo-gate doesn't help them and would become a product tax on every future change. Instead, the exact residency map:
| Data class | Primary region | Replicas | Note |
|---|---|---|---|
| Account, keys, wallet ledger | AWS us-east-1 (Virginia) | Read replicas in Tokyo and Singapore | Writes go to the primary. Asia-Pacific replicas exist for read latency. |
| Request metadata (for billing) | AWS us-east-1 | None | Single-region to keep billing counters consistent. |
| BYO credentials | Dedicated KMS in us-east-1 under its own IAM boundary | None | No cross-region replication — intentionally smaller blast radius. |
| Edge nodes | East Asia, Europe, North America | — | Forward only. No persistence at the edge. |
| Audit logs | AWS us-east-1 | Cold backup in us-west-2 | Required for compliance continuity. |
This page is the technical authority on UAN's privacy design. Everything on it is under independent audit. Security disclosures go straight to the engineering team.
UAN's privacy commitments are defined in this document. Any product decision that conflicts with it defers to it. Changes are versioned in a public repository; material changes trigger a 30-day advance notice email and a banner at the top of the page.
Scope covers the Security, Confidentiality, and Privacy Trust Service Criteria. Observation window exceeds six months. The audit partner and kick-off date are published on this page the day the engagement begins; the first report will be available in executive-summary form publicly and in full under NDA.
48-hour acknowledgement SLA. High-severity findings get a 7-day disclosure plus a public fix timeline. No bounty — maintained acknowledgement page instead.
Anything that conflicts — marketing copy, sales pitches, support answers — defers to this page.