Privacy

Vyre has no accounts. This page says exactly what stays on your device, what is sent, and what our server keeps. If something here stops being true, we’ll update this page before the change ships.

What stays on your device

• Your conversations, including generated images.
• Your key (sk_lite_…), which connects you to your credit balance.
• Connector settings and tokens, such as a GitHub token.
• Unredeemed private tokens.

Clearing your browser’s data deletes all of this. A recovery file, encrypted in your browser with a passphrase only you know, is the only way to bring it back. We never see the file’s contents or the passphrase.

What leaves your device when you send a message

Before sending, Vyre looks for people’s names, email addresses, phone numbers, card numbers, IP addresses and wallet addresses, and swaps them for placeholders like [PERSON_1]. The placeholder version goes to our server, then to OpenRouter, then to a model host. Replies are swapped back to the real values in your browser.

We ask OpenRouter to route only to hosts that don’t store prompts or train on them. If no such host is available for a model, the request fails rather than falling back.

Detection isn’t perfect. It can miss names, especially uncommon or non-English ones. Under each message you can see exactly what the model received. “Hide more” also hides places, organisations and other capitalized words, and “Send as written” turns hiding off for that chat.

What our server keeps

• A one-way fingerprint (hash) of your key and its balance. The key itself is never stored.
• How much each key has spent today, for the daily limit. It expires after two days.
• Daily totals across everyone (requests, revenue, model costs), with no link to any key.
• Short-lived rate-limit counters, keyed by a scrambled form of your network address.
• For USDC payments: an open payment request for up to an hour, then only a marker that the transaction was used, so it can’t be claimed twice.
• For private tokens: a fingerprint of each spent token, so it can’t be spent twice.

Our server does not log or store message content.

When our server does see your text

• In a chat set to “Send as written”.
• In API requests, which don’t pass through the browser. With "redact": true our server hides details before forwarding, which means it sees the raw text of that request.
• When a connector tool runs, its details pass through our server to the connector. Values hidden from the model are filled back in for the tool only.

Payments

USDC payments on Base are public on the blockchain. We don’t keep a record of which wallet paid for which key, but anyone can see the payment itself. An unlinkable top-up gives you signed tokens instead of credits; when you redeem them, we can verify them but can’t tell which payment they came from. Timing can still connect the two, so wait a while before redeeming.

If card payments are offered, they are processed by Stripe, which knows who paid.

What others can see

OpenRouter and the model host see the placeholder version of your messages. Our hosting provider and OpenRouter see network addresses as part of normal operation.