# Data retention and logging

> What the platform records about each request, what it never stores, how long records are kept, and what providers see.

Source: https://0.0.0.0:3000/docs/privacy/data-retention
Documentation index: https://0.0.0.0:3000/docs/llms.txt

Numes keeps metadata about every request so it can bill you exactly, route around failing endpoints and show you Activity. It doesn't keep your prompts or model responses.

Chat requests may explicitly send `store: false`, which is equivalent to omitting it. Stored completions aren't supported: `store: true`, `null` and other types return `400`. The field isn't forwarded and doesn't change billing metadata or provider retention policies. For provider retention and collection requirements, use `provider.zdr: true` and `provider.data_collection: "deny"`; see [Provider data policies](/docs/privacy/provider-data-policies).

## What is recorded for each request

Each request leaves a metadata record with:

- the requested model, and the provider, endpoint and price that served each try;
- the outcome, timing and finish reason, including whether you cancelled;
- usage and the exact cost, including any cache discount;
- the API key that made the request and the person who created it;
- the request ID and generation ID;
- the app origin from `HTTP-Referer`, such as `https://app.example-store.io`, for app attribution;
- the regions you requested and, when known, where the request ran.

This is what you see in [Logs](/dashboard/logs), [Activity](/dashboard/activity) and [`GET /generation`](/docs/account/usage-accounting#look-up-a-generation). Records are kept for billing, disputes and integrity, and contain no content.

## What is never stored

| Never stored | Notes |
| --- | --- |
| Prompt and response content | Messages, media, tool arguments and outputs |
| API key secrets | The full key is shown once, at creation |
| Session and cache identifiers | `session_id`, `X-Session-Id` and `prompt_cache_key` are used for routing only |
| The `user` field | Validated, then discarded. It isn't forwarded to providers |
| `X-Title` | Accepted for compatibility and discarded |
| The full `HTTP-Referer` | Only the public origin is kept |
| Your IP address | Not stored with request records |
| Card numbers | Card details go directly to the payment processor |

Operational logs exclude content, credentials, full URLs and personal identifiers such as email addresses.

Conversations in the dashboard [chat](/chat) are stored in your browser, not on the platform.

## Routing hints

When you send `prompt_cache_key`, `session_id` or `X-Session-Id`, related requests prefer the same endpoint so its prompt cache stays useful. The provider receives only an opaque hint with no content or account identifiers, never your raw value. See [Sessions](/docs/features/sessions).

## Media you send

When a message contains an image, PDF or audio URL, Numes fetches it and forwards the content to the provider, so the provider never contacts your URL. Media isn't kept after the request finishes.

## What providers see

A provider receives what it needs to serve the request and nothing that identifies you:

| Sent to the provider | Not sent to the provider |
| --- | --- |
| Messages and media content | Your account, name, email or organization |
| Tools, tool choice and response format | Your API key or its name |
| Sampling, token-limit and reasoning settings | The `user` field |
| An opaque routing hint, when applicable | `HTTP-Referer` and `X-Title` |
| | Your IP address |

Providers connect to Numes, not to your client, so they never see your network address. What a provider does with request content is governed by its declared data policy; see [Provider data policies](/docs/privacy/provider-data-policies).

Hosted tools, such as web search, run on the provider's side. Only their results, citations and artifacts come back to you; Numes doesn't keep their queries, code or call traces.

## How long records are kept

| Data | Retention |
| --- | --- |
| Request metadata and financial records | Kept as billing and integrity records |
| Activity analytics | Up to one year, in less detail for older periods. See [Activity](/docs/account/activity) |
| Saved Activity views | Until you delete them or your account |
| Support tickets | Encrypted, and deleted 90 days after the latest message. See [Support tickets](/docs/account/support) |

## Deleting your account

When you [delete your account](/docs/privacy/account-security#delete-your-account), Numes erases your names, email address, profile image, email preferences, saved Activity views and support tickets, ends your access and revokes the keys you created. Financial and audit records are kept for integrity, with past email addresses in protected form. Organizations you belonged to keep their own history.

## Limit what leaves your control

- **Require zero retention** with `provider.zdr: true`, so only endpoints that declare no retention serve the request.
- **Refuse data collection** with `provider.data_collection: "deny"`.
- **Pin geography** with `provider.regions`, for example `["DE", "FR"]`.
- **Keep secrets out of prompts.** Numes doesn't store content, but the provider receives it.
- **Use opaque values** for `session_id` and `prompt_cache_key`, never personal data.
- **Use separate keys** for workloads with different sensitivity.

Each filter narrows the set of endpoints. If none qualifies, the request fails instead of falling back to a less private endpoint. See [Provider data policies](/docs/privacy/provider-data-policies).

## Next steps

:::cards
- {shield-check} [Provider data policies](/docs/privacy/provider-data-policies) Read and filter on endpoint declarations.
- {lock} [Account security](/docs/privacy/account-security) Protect the identities and keys on your account.
- {activity} [Activity and logs](/docs/account/activity) The metadata you can inspect.
- {network} [Provider routing](/docs/routing/provider-routing) Every routing preference.
:::