Last updated: DRAFT 2026-10-16b

Privacy Policy

This draft describes what Bearer Club collects and why. California Chicken Co. d/b/a Bearer Club is responsible for this data. [TODO(COUNSEL)] draft the full policy from this outline.

What we collect

Account data: email address, name (optional), country, age confirmation, consent records, and either a hashed password or a link to your sign-in provider account.
Session data: sign-in session records, including the browser user agent, so you stay signed in and can sign out other sessions.
API key data: each key's name, a short prefix and a one-way hash. We never store the full key.
Billing data: a Stripe customer id, membership and subscription status (including your renewal date and whether auto-renew is on), credit top-ups, balance and refunds. Stripe processes card payments; we never receive or store full card numbers.
Usage metadata: for every API request, the model, endpoint, token counts, cost, latency, status and time. Kept for every key, whatever its data policy.
Playground usage: for each Playground chat that is sent to a model, the time, the model and the size in characters of the request and the answer (not their content), tied to your account and kept for 90 days. We use it to tell whether an account has used the service, for the refund guarantee.
Request content: for security, abuse prevention and debugging we store the content of each API request and its response, encrypted, and delete it after 30 days. The record of a request (model, endpoint, token counts, cost, latency, status, time and any error message) is kept for 90 days. Error records can be kept longer, until we clear them. This applies to every key, Private included. The content of Private keys is never used for training and never shared or licensed.
Research Share content: prompts and outputs from keys set to Research Share (always the case for Guest keys), stored encrypted.
Waitlist data: what you enter on the Join form (email, first name, tier interest, country, spend band, use, optional notes, handle and invite code), your consents and your browser user agent.
Support chat: when enabled, the chat window on our site is provided through Chatwoot by our customer support provider. It loads from that provider on every page where it is shown, so the provider receives your IP address and browser details and keeps an anonymous visitor record, even if you never open the chat. If you write to us there, your messages, the address of the page you were on and your browser and device details go to that provider, which stores the conversation. The chat sets a first-party cookie, cw_conversation, for up to a year to keep your conversation across pages and visits. We don't send it your name, email address or account id.
Site analytics: when enabled, we use Google Analytics 4 to count visits and see which pages and referrers bring people to the site. It receives the address of the page you are on (without the part after the question mark, except our own campaign tags such as utm_source), the page title, the page that sent you, your language, screen size, and browser and device details, and Google works out your approximate location (country and city) from your IP address without logging the address. It sets two first-party cookies, _ga and _ga_ followed by our data stream ID, for up to 13 months, holding a random identifier. We switch off Google signals and ad personalization, deny the advertising consents, and never send it your email address, name, account id, API keys or usage. Not loaded, and no cookie set, when your browser sends Global Privacy Control or Do Not Track.
Advertising measurement: when we advertise on Google or X, we measure whether the ads lead to a sign-up or a membership, using HellYeah X-Ray (xray.hellyeahai.com), a measurement service we use. When you visit bearer.club, its tracker records the address of the page you are on (without the part after the question mark), the page title, the page that sent you, your language and screen size, how long the page was in view and how far you scrolled, and it can record which links and buttons you click (their type and name, never what you type) and how fast pages load. If you arrive from one of our ads, it also records the click identifier or campaign tags in the link (such as gclid, twclid and utm_ values). It sets one first-party cookie, hy_attr, for up to 90 days, holding a random visitor id and those tags. When you create an account or buy a membership, we tell X-Ray that it happened: a sign-up, or a purchase with the plan and the amount charged in US dollars. We tie it to your visit with that visitor id and to your account with a code made from your account id that does not reveal it. X-Ray passes conversions on to the ad platforms. We don't send X-Ray or the ad platforms your email address, name, API keys, prompts or usage. None of this is loaded or sent when your browser sends Global Privacy Control or Do Not Track, and nothing is sent about an account that was created while your browser sent either one.

[TODO(COUNSEL)] review the new account, session, API key and Stripe billing categories, the advertising measurement, site analytics and support chat disclosures (what the ad platforms, the measurement service, Google Analytics and the support provider receive, cookies, whether it is "sharing", and consent for visitors in the EEA, UK and Switzerland).

How we use it

To run the service: authenticate requests, route them to models, enforce limits and spend caps, and show your usage.
To bill you and keep financial records.
To prevent fraud and abuse and to secure the service.
To measure whether our advertising works (see "Advertising measurement" above) and to count visits to our pages (see "Site analytics" above).
To email you about your account, renewal reminders and the beta. Product updates only if you opt in.
To use Research Share content ourselves and supply it to top frontier labs and other vetted buyers, as described in the Data Sharing & Research Program.

Retention by data policy

Private keys: the 30-day encrypted security copy and usage metadata described above. Never used for training and never shared or licensed.
Research Share keys: the same security copy, plus encrypted content kept for the program for up to 24 months after the request, then deleted, plus usage metadata.
Guest keys: always Research Share. Guest usage is capped at $10,000 per calendar year.
Account and billing records: kept while your account is open and as long as tax and accounting law requires afterwards. [TODO(COUNSEL)] retention periods.
Rate-limit data: IP addresses are held in memory only for the length of the rate-limit window.

Supplying Research Share content to frontier labs and other buyers may be a "sale" of personal information under the California Consumer Privacy Act (CCPA). It happens only for keys you opted in, and only for traffic after you opted in. We scrub personal data and secrets first, and that content will be used to accelerate AGI and supplied to top frontier labs for AGI purposes. Buyers are contractually barred from re-identifying anyone or reselling the data.

We don't sell or share data from Private keys.

Advertising measurement (above) can also count as "sharing" for cross-context behavioral advertising. It is only loaded when your browser sends neither Global Privacy Control nor Do Not Track, so sending either signal opts you out of it.

Your choices

Switch any Member or Executive key to Private at any time. It applies to future requests.
Use the Do Not Sell or Share My Personal Information page.
We honor Global Privacy Control (GPC) signals as a request to opt out of sale and sharing, and we don't load advertising measurement for browsers that send GPC or Do Not Track.
Ask us to access, correct or delete your data at privacy@bearer.club.

CCPA notice at collection

[TODO(COUNSEL)] categories of personal information, purposes, whether each is sold or shared, and retention, in the required format.

Information for paid users in the EEA and UK

Guest accounts aren't offered in the EEA, the UK or Switzerland at launch. Paid keys default to Private. [TODO(COUNSEL)] lawful bases, data subject rights, transfers and representative requirements.

Subprocessors and upstream model providers

Requests are sent to the model provider or host that serves the model you call, which processes them and may keep them under its own terms. Payments are processed by Stripe. Our service providers (subprocessors) are: Microsoft Azure (hosting and the database), Cloudflare (CDN, DNS and static file storage), Stripe (payments), Clerk (sign-in), Resend (email), our customer support provider through Chatwoot (website chat), Google Analytics (counting visits), and Google Ads, X and HellYeah X-Ray (advertising measurement). The upstream providers are the model providers and hosts that serve the models you call.

Security

Keys are stored only as hashes. Research Share content is encrypted at rest. Passwords are hashed. [TODO(COUNSEL)] security description.

Children

Bearer Club is not for anyone under 18. We don't knowingly collect data from children.

International transfers

We operate in the United States. [TODO(COUNSEL)] transfer mechanisms.

Contact

Privacy questions and requests: privacy@bearer.club.

Changes to this policy

We'll post updates here and tell account holders about material changes. We never apply a new data use to data collected under an earlier version.