# Privacy

> What we keep about your requests, and for how long.

**TL;DR**: for a single request we keep its host name, never the full URL.
A batch or a monitor keeps the URLs you give it, because it needs them to
run. Your key, your headers and your IP address never reach a log.

## A single request

For each request to `/v1` we keep one record: its id, the time, the key,
the engine, the result, the credits and the target's host name, like
`example.com`. We never write the full target URL, its path or its query,
your request headers, your cookies or your IP address into a log or a
table. `GET /v1/account/requests` shows you your records.

When the `url` is a PDF, Word, PowerPoint or Excel file, the record also keeps
its kind and the pages, slides, characters or cells we priced. We never log or
store the file or its text.

## A batch

A batch needs its URLs to run them. We keep them while the batch runs, and
we delete the whole batch and its items 7 days after it ends. Each result
is deleted 7 days after it is saved, whatever your account's
`retention_days` says: that setting covers request records, and a value
under 7 does not remove results sooner. You can delete
the data sooner: once a batch has finished or been canceled,
`DELETE /v1/batches/{id}` with an account key deletes its results, its URLs
and the headers and cookies you sent with it at once. Your credit ledger is
separate and stays. A `result_url` works for 15 minutes, for anyone who holds
it: treat it like a password.

## A monitor

A monitor needs its URLs to check them on schedule. They live only in the
monitor: only you can read them, and they never appear in our logs, our check
rows or our storage keys. While a check runs, its pages are a batch, so the
URLs are in our database until the check ends; then we erase them. We keep the
last copy of each page, to compare the next check with, while the monitor
exists. Each check's diff is deleted 30 days after the check. A dry test keeps
its pages until you read it, and at most 7 days. Deleting the monitor, or your
account, erases its URLs, page copies and diffs at once. Your credit ledger is
separate and stays. The webhook carries each changed page's URL, and goes only
to your own signed endpoint. [Monitors](/guides/monitors) has the details.

## A screenshot

A screenshot is a picture of the page you asked for. The browser uploads it
straight to our storage, through a link that works for that one image and
only for minutes. We store it under your account id and the request id,
never under the page's URL or host, and delete it 7 days after it is taken,
or at once when you delete your account. Its link works for 1 hour, for
anyone who holds it.
[Batches](/guides/batches) has the details.

## Network capture

With `network=true`, the responses the page loaded (their URLs and bodies)
pass through our memory to you, in the answer itself. We never log them,
store them or put them in metrics; the audit row records only how many bytes
we sent you. We read no request or response headers, no cookies and no
request bodies.

## Schema extraction

When you send `schema`, the page's main content (as markdown, 96 KB at
most), your schema and your prompt go to the model provider:
Anthropic in the US. We send no account, key, user id or anything else that
says who you are. Anthropic may keep what we send for a time under its own
terms. Your schema, prompt, the page and the model's answer are
never written to our logs or tables; the request record keeps only the token
count, the model alias and the cost. Without `schema`, no page content goes to
any model provider.

## These docs

Our sites use cookie-free, aggregate analytics. No ad trackers. Your keys,
targets and requests never reach them. (Security to confirm.)

The "Open in Playground" links put the example in the part of the URL after
`#`. Your browser never sends that part to us or to anyone else.