Last updated 29 October 2026

Privacy

The short version: there is no account, request bodies are never written to disk, and the only machine that holds your full prompt is an enclave we cannot read. The long version follows.

What we store

• Session record. A session id, a hash of your auth key, the balance, and a per day spend total. No email, name, phone or wallet is attached to it.
• Request metadata. Timestamp, model names, shard classes (for example identity, financial), exit region, token counts and provider cost. Kept for 30 days for billing and abuse control, then deleted.
• Vault entries. Secrets you store, encrypted at rest with a key derived from your password in the browser or SDK. We hold ciphertext.
• Chats and files in the dashboard. Encrypted the same way, stored as a write through volume. We cannot open them. Lose the password and nobody can recover them, including us.
• Stake and deposit records. If you stake $WISPR or redeem a deposit note, the on chain transaction and the session it benefits are recorded, because the fee rate depends on them.

What we never store

• Request or response bodies, on the gateway or on any exit. At Standard level the gateway handles plaintext in memory and drops it when the response is sent. At Protected and Confidential level the gateway only ever sees ciphertext.
• Your password. It never leaves your machine.
• Client IP addresses beyond the lifetime of the connection. Rate limiting uses a salted hash that rolls every hour.
• Cookies or third party analytics. This site sets none.

Who can see what

• Model providers see the shard sent to them, from a WISPR exit IP, under a per shard session. They never see your session id or the rest of the task.
• The Shield enclave sees the whole prompt, inside Intel TDX, with a published code measurement you can verify. Its operator (us) cannot read its memory.
• Card processors see a card payment and a session id. They never see a prompt.
• Anyone on chain can see deposits into the pool, stakes, and x402 payments. Deposit notes exist so the deposit cannot be tied to the session that spends it.

Legal requests

We can be compelled to hand over what we hold. What we hold is listed above: session ids, hashes, balances, metadata and ciphertext. We publish a transparency note on the blog when a request is received, where the law allows.

Contact

Questions about this page go to hello@wispr.xyz. Reports of a privacy bug get the same address and a fast reply.