Privacy Policy

This policy explains what T0 collects when you use t0.sikasio.com and its API, why, and what control you have over it. It is written to be read rather than to be survived.

1. What we collect

• Account data — your email address, a hashed password, your plan, and the timestamps around verification and sign-in.
• API keys — stored as a short prefix plus a one-way hash, never in a form we could read back to you, with a last-used timestamp.
• Your model provider key, if you add one — encrypted at rest with a key held only in our environment.
• Session metadata — session ids, names you chose, state, awake seconds, turn counts, workspace size, token counts reported by your provider, and timestamps.
• Workspace contents — the files you upload and the files your agent writes, stored so a session can be resumed and its results downloaded.
• Operational logs — request id, endpoint, status code, timing, key prefix and IP address, kept for debugging, abuse detection and security.
• Billing data — handled by our payment processor. We receive a customer reference and subscription state; we never see or store your card details.

2. What we deliberately do not collect

• Prompt content and agent output are never written to our logs. They pass through the gateway to reach you and are not retained outside your session.
• Your provider key is never logged, never returned by any endpoint and never written to disk in plaintext.
• We do not read your workspace files, and we do not use your files, prompts or agent output to train any model — ours or anyone else’s.
• No advertising trackers, no third-party analytics scripts, no cross-site profiling.

3. What we use it for

• Running the service: authorizing keys, starting sandboxes, streaming events, storing workspaces.
• Metering and billing: counting awake session time, turns and storage against your plan.
• Security and abuse prevention: rate limiting, quota enforcement, and investigating misuse.
• Service email: verification, password reset, billing notices, and material changes to the service. We do not send marketing email you did not ask for.

Our legal basis is performance of the contract for the first two, and our legitimate interest in a service that is not abused for the third.

4. Cookies

The portal sets one cookie: a session cookie that keeps you signed in to the dashboard. It is httpOnly, secure, and expires. The API host sets no cookies at all — it is a separate origin and authenticates on a bearer token — so nothing you do against the API can be ridden by a browser session.

5. Sharing

We share data with a small number of processors, and with nobody else:

• a payment processor, for checkout and subscription state;
• an email delivery provider, for verification and service email;
• the infrastructure and object-storage providers that host the service.

We do not sell personal data. We disclose data to authorities only where legally required, and only what is required.

6. Retention

• Workspaces are deleted when you delete the session, when it passes its ttl, or when it passes your plan’s retention window — at most 90 days.
• Operational logs are kept for a short window measured in days and then rotated away.
• Usage records are kept while your account exists, because they are what your bill is made of.
• Account data is deleted when you close your account, apart from what we must keep for tax and accounting.

7. Your rights

You can access, correct, export or delete your data. Most of it is one click in the dashboard: revoke keys, remove your provider key, delete sessions, close the account. For anything else, email us and we will act within 30 days. If you are in the EEA or the UK you also have the right to complain to your data protection authority.

8. Security

• TLS everywhere, with HSTS and a hardened header set at the edge.
• Passwords hashed with a modern memory-hard function; API keys stored as HMAC digests.
• Provider keys encrypted with AES-256-GCM under a master key held only in the environment.
• Every session runs in a locked-down container with default-deny network egress, and every authorization decision is written to an audit trail.
• Backups of account and usage data are taken off-box and restore-tested.

No system is perfect. If you find a security problem, email support@t0.sikasio.com before disclosing it publicly and we will work with you.

9. Changes

We will post any change here and update the date at the top. Material changes are emailed to the address on your account before they take effect.

10. Contact

Privacy questions, access requests and deletion requests: support@t0.sikasio.com.