// LEGAL
Privacy Policy
What we collect, why, and for how long. Short version: as little as possible, and never your prompts.
Last updated: 29 October 2026
This policy explains what Stardust LLM ("Stardust", "we") collects when you use stardustllm.xyz, the dashboard and the API at api.stardustllm.xyz, why, and for how long. We collect as little as we can to run the service.
What we collect#
| Data | Why | Kept for |
|---|---|---|
| Your wallet address and sign-in ID (via Privy) | To create your account and sign you in | While your account exists |
| Email address, only if you add one to your Privy login | Account recovery and contact | While your account exists |
| Sign-in sessions: a hash of the session token, browser (user agent) and IP address | Keeping you signed in, spotting stolen sessions | 7 days per session, deleted 30 days after it ends |
| API keys, stored only as a hash | Checking that a request is allowed | Until you revoke the key |
| Usage records: model, token counts, status, Energy cost, response time, which key was used | Billing in Energy, your usage page, abuse prevention | 90 days in detail, then only daily totals |
| Energy Vault balances and settlements | Charging usage on-chain | Mirrored from the public blockchain |
Your prompts are not stored
We do not store the content of your prompts or of the model's answers. They pass through our servers to the model and back, and are not written to our database or logs.
Who else processes your data#
- Model providers. To answer an API request we send your prompt to the provider that runs the model you picked. That provider processes it under its own terms and privacy policy. Free models in particular may be served by providers that use inputs to improve their services: don't send secrets or personal data to free models.
- Privy handles wallet sign-in. It receives your wallet address (and email, if you use one) under its own privacy policy.
- Cloudflare sits in front of the website and API for security and caching, and sees request metadata such as IP addresses.
- Our server host stores the database described above.
Blockchain data is public#
Staking, buying Energy, the Energy Vault, the Liquidity Pool and NFT mints are transactions on Robinhood Chain. Everything in them (wallet addresses, amounts, times) is public and permanent, and we cannot change or delete it.
Cookies and tracking#
We use one essential cookie to keep you signed in to the dashboard (HttpOnly, not readable by scripts). Privy and your wallet may store login data in your browser. We use no advertising or analytics trackers.
Your choices#
- Revoke API keys and sign out of all sessions in the dashboard at any time.
- Ask us to delete your account. Your usage records are removed with it; on-chain data stays public.
- Ask what data we hold about your wallet.
For any privacy request, contact us through @stardustRH on X. We may ask you to sign a message with your wallet to prove it is yours.
Security#
Traffic is encrypted end to end, keys and session tokens are stored only as hashes, and the database is not reachable from the internet. See Responsible Disclosure to report a problem.
Children#
Stardust is not meant for anyone under 18, and we do not knowingly collect their data.
Changes#
If we change this policy, we update the date at the top. Material changes are also announced on our X account.