Privacy Policy

1. Who we are

Token Supply (“we”, “us”) operates token-supply.com and the related API gateway. This policy explains what personal data we collect when you visit the site, create an account, add credit, or call the API, and how we use it.

Contact: [email protected].

2. Data we collect

Account data. Email address, one-time sign-in tokens, account role and status, authentication events, signup cohort, and records of your Terms acceptance and marketing-email choice, including timestamps, source, and Terms version. Sign-in is handled by Supabase Auth.

Wallet and billing data. Prepaid balance, ledger entries, top-up amounts, and billing intent identifiers. Card payments are processed by Stripe. Crypto payments are processed by NOWPayments. We do not receive or store full card numbers or cryptocurrency private keys. Stripe may collect tax IDs and a shipping address to calculate tax.

API usage metadata. Time, request id, API key id, plan/pool, model, status code, token counts, listed cost, and latency. We do not log API request or response bodies, so prompts and completions are not stored by Token Supply.

API keys. We store a hash of each key for authentication and an encrypted copy so you can reveal the key in the dashboard.

Technical, analytics, and advertising data. Browser requests may include IP address, user agent, page URL, referrer, device information, and basic logs needed to operate and secure the site. Ahrefs Web Analytics measures page views without cookies. It loads on every visit and records the page URL, referrer, user agent, language, and city-level location derived from IP. Ahrefs does not store the raw IP address. Independently of optional tracking pixels, we store a coarse device class (mobile, tablet, desktop, or unknown) and browser family (Chrome, Safari, Firefox, Edge, other, or unknown) on the account at signup, and we count public page views by day, path, device class, and browser family. Those counts have no visitor id, email, or IP. We do not store the raw user agent on user records. DataFast measures visits, interactions, and attribution using first-party cookies where tracking is enabled. When that tracking is on and you are signed in, the visit is linked to your account id, email, and role. When tracking is on and the visitor is signed in, Token Supply stores the DataFast visitor id and the first UTM parameters from that signup so operators can see the campaign. Those values are not stored when tracking is off. Google Analytics measures visits and interactions, and the X Pixel measures site visits and ad performance. In the EU, EEA, UK, or when we cannot determine your country, these optional trackers load only after you accept. For completed card or crypto top-ups made with tracking consent, we may also send X the purchase value, an advertising click identifier when available, a one-way hash of your email address, and the IP address and browser user agent from when you started checkout, for conversion matching. We keep that IP address and user agent for up to 3 days so the payment confirmation can include them, then they are deleted automatically. When tracking is enabled, sign-up, checkout-start, and purchase events (amount, payment method, transaction id, and an X click identifier when available, but not your email) are also sent to Google Analytics and, through our server-side tag container, to X for ad measurement. Theme and consent preferences may be stored in local storage on your device.

3. How we use data

We use this data to create and secure your account, provide API access, debit the prepaid wallet, show usage in the dashboard, send transactional email (one-time sign-in codes, secure sign-in links, and top-up receipts), prevent abuse, improve reliability, and compare coarse device and browser mix across visits, signups, API use, and paid conversion. Coarse device and browser fields are not sent to DataFast, Google, or X unless you have accepted tracking pixels.

If you choose to receive marketing email, we use your email address, consent record, and signup cohort to send relevant product news and offers and to manage marketing audiences. We do not send marketing email after you withdraw that choice.

We do not sell your personal data. We do not use API request bodies for advertising or for training our own models, because we do not store those bodies.

4. Processors and sharing

We share data with service providers who help us run the Service, including: Supabase (authentication and database), Stripe (card checkout and tax), NOWPayments (crypto invoices), Resend (transactional email), Railway (API and gateway hosting), Cloudflare (site hosting and traffic), Ahrefs (cookieless site analytics), DataFast (site analytics and attribution), Google Analytics through Google Tag Manager, including a server-side tag container on Google Cloud (site analytics and advertising measurement), and X (site visits and advertising measurement).

Underlying model providers receive the prompts you send through the gateway in order to generate completions. Their processing is governed by their own terms and policies.

We may disclose data if required by law, to protect the Service, or in connection with a merger, acquisition, or shutdown, with appropriate safeguards.

5. Cookies and local storage

The dashboard uses authentication session storage required to keep you signed in. Theme (light/dark) and your tracking choice are stored locally in your browser. Ahrefs Web Analytics does not use cookies and loads on every visit. DataFast, Google Analytics, and the X Pixel may use cookies when tracking is enabled. In the EU, EEA, UK, or when edge-derived country detection is unavailable, they are disabled by default and load only after you accept. Outside those regions, both categories are enabled unless you refuse them in the cookie control. Analytics consent loads DataFast and Google Analytics and grants Google's analytics storage signal. Advertising consent loads the X Pixel and grants advertising storage, ad user data, and ad personalization. You can accept all, accept only the categories you select, or refuse all.

6. Retention

Account, wallet, ledger, and usage records are kept while the account is open and for a reasonable period afterward so we can complete billing, security, and legal obligations. You can revoke API keys at any time. If you want an account deleted, email [email protected] from the address on the account.

7. Your choices

You can access account details in the dashboard, revoke keys, and request deletion as described above. Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to certain processing. We will not discriminate against you for exercising those rights.

Transactional email (security and receipts) is part of the Service. Marketing email is a separate choice. You can decline it during signup or unsubscribe at any time through a marketing email or by contacting [email protected].

You can accept all optional cookies, accept only analytics or advertising, refuse all, or change that choice at any time using the cookie control on this page.

8. International transfers

The Service is hosted on infrastructure that may process data in the United States and other countries. If you access the Service from elsewhere, you understand that your data may be processed in those locations.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

10. Changes

We may update this policy from time to time. The “Last updated” date at the top of this page will change. Continued use of the Service after an update means you accept the revised policy.

Related

• Terms of Service — Terms of Service for Token Supply prepaid API access. Wallet credit, usage billing, acceptable use, and account rules.