Version dated November 3, 2026
Privacy Policy
Preliminary text for legal review. Operator details, a contact for requests, governing law and specific retention periods will be completed in the final version.
This policy describes data used by the MiraRouter website, dashboard and API. Telegram and external model providers also process information under their own policies.
1. Account information
Telegram provides your user identifier and profile details within the requested sign-in permissions. MiraRouter associates that identifier with your account. We do not request your messages, phone number or permission to send messages on your behalf.
2. Usage information
The dashboard stores workspaces, key details and restrictions, funding transactions and usage information: model, time, token count, status and final charge. Technical information, including an IP address, helps protect sign-in and limit abuse.
3. Model requests
Request content and responses pass through MiraRouter infrastructure to the model provider, including through OpenRouter. The application does not include request or response content in its logs by default. External providers can have different retention and training practices. Review their policies before submitting personal or confidential information.
4. Purposes
We use information for sign-in, access control, API requests, spending reports, confirmed payments and service security. If you contact support, the information you provide may be processed to resolve your request.
5. Cookies and preferences
Cookies maintain your session, protect sign-in and remember your selected language. Your theme preference is saved in the browser. Your account remembers the last workspace you visited. A current session lasts up to seven days unless ended sooner; removing or blocking necessary cookies may require you to sign in again.
6. Recipients and transfers
Service providers include Telegram, model providers and OpenRouter, DigitalOcean and Cloudflare infrastructure, and the applicable payment service when payments are available. Each receives information needed for its role. Processing can occur in different countries. Processing agreements, the processor list and international transfer arrangements must be completed in the final policy.
7. Retention and security
Access is scoped to accounts and workspaces. Key and session authentication uses stored verification values rather than plaintext secrets. Transaction records may remain after a session ends for settlement, disputes and legal obligations. Specific retention periods and backup deletion procedures require separate approval.
8. Your requests
Depending on applicable law, you may request information about your data, corrections, a copy or deletion, and may object to processing. Records may need to be retained where there is a mandatory basis. A contact, identity verification procedure and response periods will be added after legal review.
9. Updates
Updates appear on this page with a version date. This preliminary policy must be completed with operator details, legal bases for processing and a procedure for notifying you of material changes.