Last updated: 2026-09-15.
When you call /v1/optimize, we process the text you send in memory to produce the reduced output. We do not store the content of your requests or responses. Verified in our own code: nothing from a request body is written to disk or logged anywhere in our processing pipeline.
Per API call, we store: token counts (in/out), dollars saved, the transform used, and a pass/fail verdict — for your own usage dashboard and billing. Any free-text warning message is passed through a secret-redaction filter before storage. We never store your downstream LLM provider's API key.
We store your API key (hashed, never in plain text), tenant ID, and plan tier. Payment details (card, billing address) are collected and processed entirely by Paddle, our payment processor — we never see or store your card details.
To enforce free-tier abuse limits (20 key mints per IP per day), we store your IP address with a timestamp each time you mint a free key. We do not otherwise track or store IP addresses.
Paddle (payment processing, tax, invoicing) is the only third party we share billing-related data with. We use PostHog to understand site traffic (see Cookies below). We do not sell personal data, and we do not use your request content to train any model.
We process account and billing data under contract (to provide the Service you signed up for) and free-tier abuse logs (section 4) under legitimate interest (stopping free-key abuse). We do not sell personal data or use it for advertising.
You have the right to access, correct, delete, or export the personal data we hold about you. Email contact@savetoken.org — we don't yet have self-serve account deletion in the dashboard, so requests are handled manually, typically within a few business days.
Retention: request content is never stored (section 1). Account data (hashed API key, tenant ID, plan tier) is kept while your account is active. Free-tier IP+timestamp logs are kept for abuse prevention; a deletion request removes them the same as any other personal data.
Controller: SaveToken, c/o Invictus International Consulting Services, Gurugram, Haryana, India.
When you sign in to the dashboard, we set one essential, first-party session cookie (__Host-session) so you stay logged in. It is a signed token that identifies your session, expires after three days, and is not shared with anyone.
We use PostHog to see how visitors find and use this site (pages viewed, traffic source, general location), configured not to set cookies or use browser storage. We do not use advertising cookies, and we do not use your request content for analytics.
SaveToken is a developer/business API and is not directed at, or knowingly used to collect data from, children.
We may update this policy; continued use of the Service after an update constitutes acceptance.
SaveToken, c/o Invictus International Consulting Services, Gurugram, Haryana, India. Contact: contact@savetoken.org