Privacy policy

What this policy covers

Screwtape.ai is an API that returns a pass, fail, or retry verdict on another agent's output, and that scores agreement across several agents. This page describes what version 1 of the software actually stores and sends. If a practice is not listed here, this deployment does not do it.

Judged content

A judge call carries a task, an agent output, and optional evidence and criteria. A consensus call carries a task and the agents' answers. By default that content lives only in memory for the life of the request. It is not written to the database and it is not written to logs.

Retention is opt-in. Send retain set to the boolean true, and authenticate with an API key, to store that request and its result for 24 hours. Any other value is rejected or ignored, so a string does not opt you in. Keyless x402 calls cannot turn retention on. You can delete a stored row, and deleting the API key deletes every row tied to it. An hourly job deletes expired rows. The service does not keep judged content you did not ask it to keep.

Account data

Creating a key stores a SHA-256 hash of the key, a short display prefix, the email and name you submit, a credit balance, and the time it was created. The full key is returned once in the response and is not stored. A daily counter stores how many calls the key made on that UTC date, and counters older than two days are deleted.

DELETE /v1/keys/me removes the key, its counters, its payment records, and its retained judgments. If you lose the key, it cannot be looked up, because only the hash was stored.

Rate limits and payments

Rate limiting stores a hash of the caller IP, a time window, and a count. The raw IP address is not stored. Those rows expire within a day.

Card checkout is optional and, in this version, test mode only. Stripe receives a price, an internal key id, and the pack name. It does not receive judged content or the API key. We store the Checkout session id, pack, credits granted, key id, and time. We do not store card numbers. Live-mode Stripe events are ignored and do not add credits.

A keyless call can send an x402 payment header instead of an API key. The payment payload, not the judged content, is sent to a facilitator to verify and settle the payment on Base. We store the payment nonce and payer address for up to 48 hours to reject replays. Stub mode is off. If it is turned on and every facilitator is unavailable, nothing is settled on-chain, and the API response says so.

Model providers and logs

If the operator has configured an LLM API key, the task and the agent output (plus evidence, criteria, or answers) are sent to that OpenAI-compatible endpoint for the request. The default base URL is Groq, and it is used only when a key is present. With no LLM key, judging stays inside the worker and is not sent to a model provider.

Each request writes one log line with four fields: request id, endpoint, status, and latency. The endpoint is the method and path, without a query string. A failed model call adds a separate line that contains only the provider HTTP status code. Logs do not include bodies, API keys, emails, IP addresses, or payment payloads. Cloudflare, which hosts the worker, may keep its own connection metadata under its terms. This software does not add customer content to those logs.

Browser, cookies, and public pages

The site does not set cookies and does not load analytics or third-party fonts. The signup page can keep a new API key in sessionStorage in your browser so you can copy it. That value is not sent anywhere except back to this API as a Bearer token, and it stays on the device until you clear it or delete the key.

The public site is the landing page, the docs, the privacy policy, llms.txt, the OpenAPI document, the MCP server card, robots.txt, the sitemap, and the API. Admin operations are protected by a separate secret and are not described in the public OpenAPI file or the public docs. Source maps are not published.

What we do not do

We do not sell data, run ads, or train a model on your calls. There is no support inbox in this version. To delete what we store, call DELETE /v1/keys/me while you still have the key.