Privacy

• Account — your email address, and a hash of your password if you signed up with one. If you used Google or GitHub, the identifier they return.
• API keys — a name you choose, a SHA-256 hash of the key, and the time it was last used.
• Usage — per request: the model, the deployment that served it, token counts, latency, HTTP status, and the computed cost.
• Credit — an immutable ledger of every grant and debit on your account.

Prompts and completions are not stored. Request and response bodies pass through the gateway to the upstream model and are not written to the database. What is recorded is the shape of the request — how many tokens, which model, what it cost — not its content.

There is no analytics script, no advertising pixel, and no third-party tracker on this site.

Knot is a gateway, not a model. Every request you make is forwarded to a third-party model provider, and your prompt necessarily reaches them — that is what the service does. Your request is subject to that provider’s own handling and to the content filtering they apply.

Account data and usage records are held in Convex, hosted in the EU (eu-west-1). The application is served by Vercel. Password-reset email is delivered through Gmail.

Your data is not sold, rented, or shared with anyone beyond the infrastructure providers named above, each of which processes it only to run the service.

Usage and ledger records are kept for as long as the account exists, because they are the record that explains what you were charged. Revoked API keys are retained as revoked rather than deleted, so past usage stays attributable.

To have an account and its records deleted, use the contact in /.well-known/security.txt.

One session cookie, set when you sign in, used only to keep you signed in. There are no analytics or advertising cookies, which is why this site has no cookie banner.

Knot is an invite-only preview operated by a small team. This notice describes what the software actually does today and will be updated when that changes.