Privacy Policy

Effective Date: November 5, 2026

This Privacy Policy describes the exact data that Unlimited DeepSeek (unlimited-deepseek.com) collects, stores in PostgreSQL or server memory, shares with third-party infrastructure providers, and omits from storage.

1. What We Do Not Store

Unlimited DeepSeek meters API usage by token count without recording the contents of your conversations:

No Prompt or Completion Bodies: When you call POST /v1/chat/completions or POST /v1/messages, our server parses the incoming JSON body in memory only to read the model and stream fields, rewrite the model name to its upstream identifier, and (for OpenAI streams) enable stream_options.include_usage. Response payloads and SSE chunks are scanned in memory solely to read token counters (prompt_tokens, completion_tokens, cached_tokens, or Anthropic equivalents) and rewrite the model identifier back to the public name. Neither your prompts, system instructions, tool calls, nor model completions are ever written to PostgreSQL or disk by Unlimited DeepSeek.
No Plaintext Passwords, Session Tokens, or API Keys: Passwords are hashed with Argon2id before storage. Browser session tokens and API keys (cp-...) are hashed with SHA-256 before insertion into PostgreSQL; only the 12-character key prefix (cp-xxxxxxxxx) is stored in plaintext so you can recognize your keys in the dashboard.
No Raw Client IPs Stored in Database or Memory: Calls to /v1/models, /v1/chat/completions, and /v1/messages do not write client IP addresses or User-Agent headers to our database, nor do the operators of Unlimited DeepSeek forward your IP address or User-Agent header to the upstream gateway. On sign-up, the client IP is immediately hashed in memory with a daily-rotating random salt; the raw IP address is never stored.

2. What We Store in PostgreSQL and Memory

Our database and server process store the following data:

Account Records

When you sign up, we store your internal numeric id, your site id, your normalized lowercase email address, your Argon2id password hash, your prepaid balance in integer picodollars, a disabled-account flag, and the account creation time.

Free-Trial Abuse Check

When you sign up we store two salted SHA-256 hashes so one person cannot claim the free trial repeatedly: one of your canonical email address (kept, so a deleted account cannot claim again) and one of your network address (IPv4 or IPv6 /64), which is erased after 24 hours. The salt lives only in the database; neither the address nor the email can be read back from the hashes. If sign-up is protected by Cloudflare Turnstile, Cloudflare sees the challenge request from your browser under its own privacy terms.

Browser Sessions

Signing up or logging in creates a 32-byte random token sent to your browser in the session cookie (HttpOnly, SameSite=Lax, 30-day Max-Age, and Secure when served over HTTPS). Our sessions table stores only a SHA-256 hash of the token, your user_id, the expiry time (30 days from creation), and the creation time. Expired session rows are purged automatically at server startup and every 6 hours.

API Keys

Each API key you generate creates a row containing an id, your user_id, your chosen key name (up to 60 characters), the 12-character prefix, a SHA-256 hash of the key, an optional per-key requests-per-minute limit, a revocation time (set when you delete the key), the last time the key was used (updated on every proxied API call), and the creation time.

Per-Request Usage Metadata

Every proxied call to /v1/chat/completions or /v1/messages writes one row to the usage table containing:

id, user_id, and api_key_id
model (public model ID) and endpoint (/v1/chat/completions or /v1/messages)
status (upstream HTTP status code, or 502 on upstream connection failure)
input_tokens, cached_tokens, and output_tokens
cost_pusd (picodollars debited; 0 if status >= 400)
latency_ms (round-trip duration in milliseconds) and a stream flag (boolean)
the creation time

Rows in usage older than USAGE_RETENTION_DAYS (default 90 days) are deleted automatically at startup and every 6 hours.

Balance Ledger

Every change to your balance inserts an immutable ledger row with an id, your user_id, the kind (topup, usage, adjust, or refund), the signed amount in picodollars, the balance after the change, a reference string, and the creation time.

Crypto Payments, Chain Transfers, and Webhook Events

payments table: When you initiate a top-up order, we store your user_id, the provider (tron for USDT-Tron, solana for USDC-Solana, or optional nowpayments), the provider reference, the order id (formatted as <site_id>_<random 16 hex>), the price in US cents, the payment currency, the exact payment amount, the amount actually paid, the deposit address, the order status, the credited amount in picodollars, and the creation and update times.
chain_transfers and watcher_state tables: For USDT-Tron (tron) and USDC-Solana (solana), an in-process watcher polls the blockchain for incoming transfers to our deposit address on each network (for Solana, our derived USDC associated token account). Every transfer is recorded in chain_transfers with the chain, transaction id (on-chain hash or signature), log index, sender wallet address, amount in micro-units, block timestamp, status (new, credited, or unmatched), matched order id (when applicable), and creation time. watcher_state stores the latest polled timestamp, block cursor, or signature cursor per chain.
payment_events table: The default deposit-address watchers do not receive webhooks and write no rows to payment_events. If a site enables the optional NOWPayments provider, callbacks store the provider, order id, status, signature validity, and the parsed callback JSON. Rows in payment_events older than EVENT_RETENTION_DAYS (default 90 days) are purged every 6 hours.

Operator Webhook Queue

If a storefront configures an operator webhook_url, internal events (user.created, payment.credited, and balance.low) queue a JSON payload containing the user id and the relevant USD balance or credit amount in webhook_deliveries. Delivered rows older than WEBHOOK_RETENTION_DAYS (default 7 days) are purged every 6 hours.

In-Memory Rate Limiters

To prevent brute-force attacks and enforce rate limits without logging raw IPs or emails, Unlimited DeepSeek records timestamps in an in-memory Map keyed by:

signup:<salted_hash>: hashes the client IP using an in-memory random UUID salt that rotates daily.
login:<salted_hash>: hashes the lowercased email address with the same daily-rotating in-memory salt.
topup:<user_id>: per-account top-up throttling.
key:<api_key_id>: per-key requests per minute.

Expired 60-second windows are swept from memory every 60 seconds.

3. Third Parties and Network Visibility

Even though Unlimited DeepSeek does not store your prompts or completions, operating an API proxy and accepting cryptocurrency over the internet involves external parties:

Upstream Gateway and Model Providers (DeepSeek and Zhipu AI / Z.ai): To generate completions, Unlimited DeepSeek forwards your request payload (messages, prompts, system instructions, temperature, and tool schemas) over HTTPS to our upstream gateway, which routes the request to the underlying model providers (DeepSeek and Zhipu AI / Z.ai). Those upstream services receive your plaintext prompt to run inference and process it under their own terms and privacy practices. Do not send unencrypted secrets, regulated personal data, or confidential keys in prompts.
Cloudflare (CDN and Tunnel): Traffic to unlimited-deepseek.com passes through Cloudflare, which acts as our reverse proxy, CDN, and TLS termination layer. As the edge proxy, Cloudflare sees your client IP address, TLS fingerprint, HTTP headers (User-Agent), and decrypted HTTP request and response bodies in transit, and supplies the cf-connecting-ip and x-forwarded-for headers hashed by our signup rate limiter.
Payment Infrastructure (TronGrid, Solana RPC, and Optional NOWPayments):

USDT-Tron and USDC-Solana (Direct Watcher): Stablecoin top-ups on TRON and Solana are watched directly by the operators of Unlimited DeepSeek, which poll TronGrid (api.trongrid.io by default) and a Solana JSON-RPC endpoint (api.mainnet-beta.solana.com by default) for incoming transfers to our deposit address on each chain (for Solana, our derived USDC associated token account). Those RPC providers see our server IP querying our deposit address and return public blockchain transfer logs.
Optional Second Provider (NOWPayments): If a storefront is explicitly configured to use NOWPayments as an optional alternative processor, creating an invoice sends the USD price, currency code, callback URL, description, and random order id to NOWPayments.

Public Blockchains: Cryptocurrency transfers on TRON, Solana, and any other supported network are broadcast to public peer-to-peer ledgers. Anyone can permanently inspect sending addresses, deposit addresses, transaction hashes, timestamps, and token amounts on-chain. Because our TRON and Solana rails use a single deposit address per chain with a unique amount per order, all customer deposits on each network arrive at the same public address.

4. Data Categories, Purpose, and Retention Schedule

The table below lists every category of data handled by the operators of Unlimited DeepSeek, its storage location, its purpose, our target retention policy, and whether that retention limit is implemented in the current service.

Data Category	Storage Location	Purpose	Target Retention	Implemented?
Prompt & completion bodies (`/v1/chat/completions`, `/v1/messages`)	Process RAM only during request/stream forwarding	Forward payload to upstream provider and count input/cached/output tokens	Target: 0 days (discard immediately after response completes)	yes (never written to PostgreSQL or disk)
Per-request usage metadata (`usage`: user ID, key ID, model, endpoint, status, token counts, cost, latency, stream flag, timestamp)	PostgreSQL `usage` table	Per-token billing, 30-day account dashboard summary, abuse/error auditing	`USAGE_RETENTION_DAYS` (default 90 days)	yes (deleted at startup and every 6 hours)
Payment records, ledger entries, and on-chain transfers (`payments`, `ledger`, `chain_transfers`, `watcher_state`)	PostgreSQL `payments`, `ledger`, `chain_transfers`, `watcher_state` tables	Idempotent crypto crediting, unmatched transfer resolution, balance audit trail, accounting	Kept as accounting and audit records	yes
Payment webhook events (`payment_events`: optional NOWPayments callback payload)	PostgreSQL `payment_events` table	Webhook verification and delivery audit when optional NOWPayments is enabled	`EVENT_RETENTION_DAYS` (default 90 days)	yes (every 6 hours)
Account credentials and balance (`users`: plaintext lowercase email, password hash, picodollar balance, disabled flag, timestamp)	PostgreSQL `users` table	Account authentication and prepaid credit tracking	Retained while the account is active, until the user requests deletion	no (no self-service or admin account deletion endpoint exists; an account can only be disabled)
Browser sessions (`sessions`: SHA-256 token hash, user ID, expiry timestamp)	PostgreSQL `sessions` table and the session cookie	Authenticate dashboard requests for up to 30 days	30 days (delete on sign-out or upon expiration)	yes (sign-out deletes the row, expired rows are rejected on read, purged every 6 hours)
API keys (`api_keys`: name, 12-char prefix, SHA-256 hash, RPM limit, revocation time, last-used time)	PostgreSQL `api_keys` table	Authenticate `/v1/*` calls and enforce per-key RPM limits	Active until revoked, then purged after the usage retention window	partial (revoking sets a revocation time and blocks use immediately, but rows stay in PostgreSQL permanently because usage rows reference them)
Operator webhook queue (`webhook_deliveries`: event, JSON payload with user id and USD amounts, error state)	PostgreSQL `webhook_deliveries` table	Deliver operational notifications (`user.created`, `payment.credited`, `balance.low`) to the site operator	`WEBHOOK_RETENTION_DAYS` (default 7 days) after delivery	partial (delivered rows are purged every 6 hours; failed rows stay until manually cleared)
Rate-limit counters	In-memory `Map` in the rate limiter	Throttle signup spam, login brute-forcing, invoice flooding, and per-key RPM abuse	60-second sliding window in process memory, swept every minute	yes
Unhandled route and background exception logs	Process standard error	Diagnose unexpected server, webhook, or watcher crashes	Ephemeral operational logs	partial (only unhandled exception messages, HTTP method, and path are printed to `stderr`; retention is controlled by the host service manager or container log rotation)

5. Your Choices and Contact

You can view your active API keys, revoke keys, inspect your recent usage, review your balance ledger and payment history, or terminate your current browser session directly from the dashboard.

For privacy inquiries or manual data requests, contact the support contact that will be published on this site (it is being set up; keep your transaction id until then).