Privacy

This page describes what happens to your data when you call the Bayle API or use the web chat at chat.bayle.ai. It states what the code does today. Where a guarantee depends on the model you pick rather than on Bayle, it says so.

How a request is handled

A request to https://api.bayle.ai is received by Bayle’s API, checked for a valid key, and passed to the model infrastructure that runs the model you named. The reply comes back the same way. Bayle’s API holds no database, cache or session store: it does not keep your prompts, the model’s replies, or generated images and video once a request has finished.

Your prompts do pass through Bayle’s API while a request is being served, so this page does not claim that Bayle cannot see them. What it claims is narrower and checkable: Bayle’s code does not store them and does not write them to its logs.

Privacy levels

Every model in the catalog carries one of two privacy levels. The level belongs to the model, so two models of similar quality can differ here.

Level	What it means	What it does not mean
Private	Zero data retention. Your prompt and the reply exist only while the model is running; they are not kept afterwards and are not used for training.	That nobody processes your content. The model still has to read it to answer.
Anonymous	Your identity is hidden from the model provider. The request goes out in Bayle’s name, without your IP address or account.	That your content is private. The provider still sees the prompt and the reply, and keeps them under its own policy.

A model’s level comes from the catalog’s metadata for that model. Bayle reports it as given; it does not run its own audit of each model’s infrastructure.

Choosing a private model

Two ways to find one.

In the docs. Open the Models tab. Every card shows its privacy level, and you can filter the list to Private models only.

From the API. GET /models needs no key. Each model’s model_spec.privacy field reads private for a Private model; anything else is Anonymous.

curl -s "https://api.bayle.ai/models?type=text" \
  | jq -r '.data[] | select(.model_spec.privacy == "private") | .id'

Pass one of those ids as model in your request. Nothing else changes: the same endpoints, the same key, the same request body.

What Bayle’s API keeps

One log line per request. It carries exactly five fields: the HTTP method, the path, the status code, the duration, and a request ID. It does not carry headers, request or response bodies, prompts, or keys. The logger is built from an allow-list of those five fields, so anything not on it is never written.
Error diagnostics. When a request fails, Bayle logs the reason it failed (a timeout, a malformed body, a stream that ended early). It does not log the request that caused it.
Hosting access logs. The platform the API runs on keeps its own standard access logs: the URL, status, latency, client IP address and user agent. These exist for any web service and carry no request body.

Bayle’s chat completions add no system prompt of their own. The model sees the messages you send, and only those.

Keys and balances

Your API key is never written to a log.
The record that holds your key’s balance and tier is indexed by a one-way hash of the key, not by the key itself.
Where Bayle keeps a copy of a key it issued, it is in an access-controlled secret store, not in a database or a log.
Top-ups keep a payment record so the balance can be credited and reconciled.

The web chat

chat.bayle.ai is a client of the same API, with one difference that matters for privacy: your browser never talks to the API directly. Each request goes to the chat’s own server, which adds your key and forwards it, so the key never reaches the page’s JavaScript.

Where	What is kept
An `HttpOnly`, `Secure`, `SameSite=Strict` cookie	Your API key. Page scripts cannot read it.
Your browser’s IndexedDB	Your chats, messages, generated images and video, and your settings. Never the key.
Your browser’s session storage	The message you are typing and have not sent yet.
Two plain cookies	Your language and your display currency.

Chat history lives only in the browser that holds it. It is not copied to Bayle’s servers, so clearing your browser’s site data deletes it, and another device will not see it. Searching your history runs locally too.

The chat’s server passes each turn to the API and keeps no copy of it. To keep the conversation on course it adds one short system message of its own to each turn.

Three things the chat does that the API does not:

Page-view analytics. The chat counts page views with Plausible. It sends the page address and nothing else: form submissions, outbound links and downloads are switched off, and no chat content is sent.
The exchange rate. To show prices in reais, the browser fetches a public USD/BRL rate. The request carries nothing about you.
The free-key check. When you claim a free first-access key, the chat runs a bot check and a device check so a key goes to one person. The device and IP values from that check are kept only as one-way hashes, and never alongside the key.

Response language

The API answers in English or Brazilian Portuguese depending on your Accept-Language header, and echoes the language it used in Content-Language. This changes error messages only; it does not change what the model writes. See Response language.

What this page does not promise

That Bayle never sees your prompts. They pass through Bayle’s API to reach the model.
That an Anonymous model keeps nothing. It hides who you are, not what you send.
That every Private model runs on any particular hardware or encryption scheme. Private means zero data retention, as described above.