InferIndex privacy policy

InferIndex is a service operated by Euron Consulting Ltda, Brazil. Contact: contact@inferindex.dev.

Last updated: 2026-10-11. This policy covers the InferIndex public API (https://api.inferindex.dev) and its MCP server (https://mcp.inferindex.dev/mcp), and the InferIndex website. InferIndex publishes public price data about AI model APIs. The API, the MCP server and the public pages of the website need no sign-in. An optional free account gives access to an API key: if you create one, we keep your email address as described in section 1. The API and the MCP server set no cookies. The website sets cookies only in your account space, and only the ones strictly necessary to sign you in, described in section 1; it sets no other cookie and uses no advertising trackers. The website pages load our own scripts, which run the page controls (such as the theme button, filters and copy link) and count clicks to sellers, and Cloudflare Web Analytics; the API and the MCP server load none.

1. Data we collect

• Aggregated usage counts. For each API request we increment a daily counter made of:
  • the date and the route (for example /cheapest);
  • the requested model name or model search term (normalized and truncated to 64 characters);
  • the API key identifier or anonymous, and the HTTP status;
  • whether the answer came from cache;
  • whether the request came through the MCP server (and then the name of the tool) or from a page of our website;
  • whether it is our own internal traffic (our monitoring and tests) or external.
  To recognise our own traffic we look at request headers such as the user agent, without storing them. We do not store your IP address, your user agent or any other request parameter in these counters.
• Account and API key (optional). You can create a free account with your email address to get an API key. There is no password: you sign in with a one-time link, valid for 15 minutes, that we email to you, or with your GitHub or Google account. We store:
  • your email address, in clear text, and a SHA-256 hash of it (without any "+" suffix and, for Gmail, without the dots) so that one address gets one account;
  • when the account was created and verified, and the last day you signed in;
  • the hash of the sign-in link and its expiry time, erased as soon as the link is used;
  • your sessions: the hash of a random token, an anti-forgery token, and the creation and expiry dates, with no IP address or browser information (five sessions at most per account);
  • for your API key: its SHA-256 hash (never the key itself, neither in our database nor in our logs), its tier, its creation date, the last day it was used and its revocation date if any.
  The key is shown once in your account space, and we cannot show it again.
• Account totals. Each week we keep totals of sign-ins and accounts created, by method (email link, GitHub or Google), of accounts deleted by their owner, and of accounts removed for inactivity. They are plain counts, linked to no account, with no address and no identifier. The method you use to sign in is not stored with your account, and counting it adds no GitHub or Google identifier to it.
• Your email address. We use it only to send you sign-in links and, if needed, service messages about your account or your key. We never send marketing, and we never share the address. The sign-in email contains the link and the date and time of the request, and nothing else about you: no IP address, no device, no key. Emails you send us are kept in our mailbox.
• Cookies. We set cookies only in your account space, never on the API, the MCP server or the public pages. They are strictly necessary for the service you asked for, so they need no consent banner, and we use them for nothing else.
  • Session cookie, set when you sign in: HttpOnly, Secure, SameSite=Strict, limited to the /account path. It lasts 14 days, or until you sign out.
  • Round-trip cookie, set only when you click the GitHub or Google button: HttpOnly, Secure, SameSite=Lax, limited to the account sign-in path. It lasts 10 minutes and is deleted when you come back, whether the sign-in worked or not. It holds the provider you chose, the language and a random number that ties the way out to the way back; no personal data.
• Sign-in with GitHub or Google. If you choose it, GitHub or Google authenticates you and tells us your verified email address.
  • From GitHub, we read the addresses of your account and keep only the primary one, and only if GitHub states it is verified. We ask only for the user:email permission (read access to your email addresses).
  • From Google, we receive the address of your account and whether it is verified. We ask only for the openid and email permissions.
  • We do not read your contacts, files, repositories or any other data. We keep nothing else: no name, no picture, no identifier of theirs, and no access token or refresh token from GitHub or Google.
  • We use the address only to identify your InferIndex account and to send you the sign-in links and service messages described above; nothing else. No email is sent for this sign-in.
  • GitHub or Google processes your sign-in under its own privacy policy, and learns that you sign in to InferIndex, and when.
  • InferIndex's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Sign-in link form. The form for asking a link uses Cloudflare Turnstile to check that a person fills it in. Turnstile sets no cookie. To verify the check, we send Cloudflare the token it gave your browser and your IP address; we do not store the IP address. Cloudflare Email Service sends the sign-in emails on our behalf, so it processes your address to deliver them. Requests are rate-limited per IP address, like the API.
• Theme preference. If you choose a light, dark or system theme, the website keeps that choice in your browser (local storage, under the name theme). It stays on your device and is never sent to us. It is not a cookie.
• Rate limiting. Requests are rate-limited per IP address, or per API key when one is sent. The counter of the current minute is kept under a keyed hash of the IP address (not the address itself), or under the key identifier, and deleted about a minute after that minute ends. We keep only hourly totals of requests and refusals, with no IP address and no identifier. Cloudflare also keeps its own counters for about a minute, as a safety net.
• Technical logs. Our hosting provider, Cloudflare, records technical logs and traces of requests to our service, which may include the URL, time, user agent, IP address and approximate location. They do not include your API key. We use them only to operate and debug the service.
• MCP server. The MCP server stores nothing from your conversation. Each tool call is answered by the matching public API route and is counted like any API request, as described above (route, model name, key identifier or anonymous, status, cache, tool name, internal or external). The other tool arguments, such as token counts or filters, are not stored.
• Website statistics. Our server counts page views per day, page and language (English or French), without the search terms you type:
  • To estimate the number of distinct visitors per day, it computes a one-way keyed hash of the date, your IP address and your user agent (the key is secret and is not stored with the data), and keeps only a statistical summary of these hashes (a HyperLogLog sketch: 1,024 small numbers per day).
  • The hash itself, your IP address and your user agent are never stored, and the summary cannot be used to list visitors or to link your visits from one day to the next.
  • Our own traffic, known robots and command-line tools are not counted as visitors.
  • For AI assistants we keep two daily totals only: the number of pages served to the agents that identify themselves as such (for example GPTBot or ClaudeBot), and the number of page views by visitors who arrive from ChatGPT, Claude or Perplexity. Each total is stored per day as a name from a fixed list and a count: no IP address, no user agent, no referring address and no page address is stored.
  • Where visitors come from. For each page view we also add one to a daily total by language and by family of origin: search engine, X, GitHub, directory, AI assistant (the second total above), forum or community, another site, navigation within our site, or direct access.
  • During the request, our server compares the referring address and the utm_source parameter with closed lists of sites, only to choose the family, and then discards them. We store only the day, the language, the family (one of the nine above) and a count: never the referring address, its domain, its path, its query or the words searched. Anyone can build a link that carries a utm_source, so these totals give orders of magnitude, not exact counts. This count is made by our server, with no script.
  • Broken links. When a visitor reaches a page that does not exist (a 404 error) from one of our own pages, we add one to a daily total, to spot broken links on our site. During the request, our server compares the host of the referring address with ours, only to know whether the link came from our site, and then discards it. We store only the day and a count: never the page requested, the page the visitor came from, the language, the IP address or the user agent.
  • The server-side counts above (page views, visitors, origin, broken links) involve no cookie, no script and no third-party service.
• Clicks to sellers. Our own scripts count clicks on links that lead to a seller's site (such as "Go to offer", "See pricing" or "Seller's site").
  • When you click, your browser sends a signal to our own server that carries only the seller's key, taken from a fixed list, and the language of the page. We store the day, the seller, the language and a count. We never store which model or offer you clicked, the page you were on, your IP address or the exact time.
  • These are declared clicks: because the signal comes from your browser, the totals are a minimum and can be altered at the margin.
  • The link itself goes straight to the seller's site, not through our domain, and the seller's site then handles your visit under its own privacy policy.
  • This count sets no cookie and uses no local storage; the only thing our scripts keep in your browser is your theme choice, described above.
• Cloudflare Web Analytics. We use Cloudflare Web Analytics, a cookieless analytics service, to count page views on our website. The pages of the website load a small script from Cloudflare (static.cloudflareinsights.com) that sets no cookie and uses no local storage. It reports:
  • the page address (domain and path) and the referring page;
  • your browser, operating system and device type;
  • your approximate country;
  • page performance measurements (loading time and Core Web Vitals).
  Cloudflare processes this data under its own privacy policy; see also Cloudflare Web Analytics. It is not used on the API or the MCP server.

2. How we use and store data

We use this data only to run the service: rate limiting, abuse prevention, capacity planning and debugging. We do not sell it, and we do not use it for advertising or to build user profiles. Data is stored with Cloudflare: the database (Cloudflare D1) runs in Western Europe, and encrypted-at-rest database backups (Cloudflare R2) are stored in Eastern North America.

3. Sharing with third parties

Cloudflare hosts the service and processes the data above on our behalf, including the Turnstile check and the delivery of the sign-in emails. If you choose to sign in with GitHub or Google, that provider takes part in the sign-in as described in section 1. UptimeRobot monitors the availability of our public endpoints; it sends its own test requests and receives no user data. We do not share user data with anyone else.

4. Retention

• Aggregated usage counters, website statistics, origin totals, broken-link totals, seller-click totals, account totals and hourly rate-limit totals are kept while the service operates. They contain no IP addresses and no user agents.
• An account whose address is never verified is deleted after 24 hours. An account with no sign-in and no API call with its key for 12 months is deleted with its address, and its key is revoked. Sessions are deleted when they expire (14 days) or when you sign out.
• You can delete your account yourself from your account space. Your email address, your sessions and your account are then deleted at once, with no grace period, and your API key is revoked. The usage counters stay, linked to the key identifier only, never to your address. The record of a revoked key (the hash of the key, its dates and tier) is kept while the service operates.
• Cloudflare technical logs are kept for 7 days, then deleted.
• Deleted data can remain in backups until they expire: database history for 30 days, and database exports, kept 90 days (daily exports) and 400 days (monthly exports), then deleted automatically.

5. Your rights and contact

You can ask to access, correct or delete data about you (for example your email address and your account), as provided by the GDPR, the LGPD and similar laws. The fastest way is to delete your account yourself from your account space: your address, your sessions and your account are deleted at once, and your key is revoked. You can also write to contact@inferindex.dev, for this or for any question about this policy.