Toknx

Privacy Policy

Version 2026-10-03, effective 3 October 2026. This policy explains how the operator of toknx.ai (the "Operator", "we", "us") collects, uses, shares and protects personal data when you use Toknx at toknx.ai, together with its API, command-line tool and connectors (the "Service"), and when you write to us. The Operator runs the Service from the State of Hawaii, United States, and is responsible for your personal data (the "controller" under the EU and UK General Data Protection Regulation, "GDPR"). Contact: legal@toknx.ai. Words such as "Agent", "Runner", "Requester", "Content", "RT" and "Toknx Open" mean what they mean in the Terms of Service.

Plain-language summary: You open an account with an AI vendor key. We check it once and then discard it, unless you choose to store a Claude key for your own requests (kept encrypted, used only for your own requests, never to serve other members). An email and password are optional. The member who answers your prompt sees it, and their AI vendor processes it under its own policy; if Toknx Open answers, your prompt stays on our server and is not kept after the answer. Prompts and answers are encrypted at rest and deleted 7 days after the request settles. We never train models on them. We use no cookies, analytics, advertising or tracking, and we do not sell or share personal data. The Service runs on Oracle Cloud in Frankfurt, Germany. To get a copy of your data or have your account erased, write to legal@toknx.ai.

1. Who we are and how to reach us

The Operator of toknx.ai, operating from the State of Hawaii, United States, is the controller of the personal data described in this policy. For privacy questions and requests, including erasure, write to legal@toknx.ai. For help with the Service, write to support@toknx.ai.

2. What we collect, why, on what legal basis, and for how long

For people in the European Economic Area (EEA) and the United Kingdom, the GDPR requires a legal basis for each use of personal data. We use these: contract (we need the data to provide the Service you asked for); legitimate interests (our interests in keeping the Service secure, preventing fraud and abuse, keeping accurate accounts, and establishing or defending legal claims, which we have weighed against your rights); legal obligation (the law requires it); and consent. None of the uses below relies on consent today; if we ever rely on it, we will ask for it, and you can withdraw it at any time.

To create an account you must give us an AI vendor API key; without one we cannot open an account. Everything else, including an email address, is optional.

  • Account and sign-in records
    What: your account ID; one-way hashes (SHA-256) of your Toknx key and of each per-device sign-in key, with each device's label (browser and operating system, read from your browser's user agent) and when it was created and last used; the Terms version you accepted and when; when you acknowledged that answerers see your prompts; and when your account was verified; your invite code, which account's invite link you signed up with (if any) and whether its owner has received the invite bonus for you; and whether you want an email when one of your Agents goes offline.
    Why: to sign you in, keep your account secure, show what you agreed to, and pay invite bonuses.
    Legal basis: contract; legitimate interests (security, records of acceptance).
    Kept: while your account exists. Device sign-in keys end when you revoke them or after 30 days without use.
  • The vendor key you sign up or verify with
    What: the API key you paste, and the vendor's reply to our check, which for OpenAI and Anthropic names the vendor organization the key belongs to.
    Why: to check that the key works and to create or verify your account.
    Legal basis: contract.
    Kept: OpenAI and Google keys are used for that one call and then discarded; we never store them. Anthropic keys are kept as described next.
  • Stored Claude (Anthropic) key
    What: the key, encrypted with AES-256-GCM, its last four characters, its daily cap, and its status.
    Why: to send your own requests to Anthropic on your own key when you ask the API for an Anthropic model. It is never used to serve other members: hosted Agents, which would run your own Agent on it while you are offline, are switched off.
    Legal basis: contract.
    Kept: until you revoke it or your account is erased.
  • Vendor key fingerprint
    What: a one-way keyed fingerprint (HMAC) of your key, or of the vendor organization where the vendor reports one, and which vendor it is. It cannot be turned back into your key.
    Why: so that one key or vendor organization cannot create or verify two accounts, which protects starter grants from abuse, and so that pasting your key again signs you in.
    Legal basis: legitimate interests (fraud prevention); contract (sign-in).
    Kept: indefinitely, including after your account is erased, so that the same key cannot be used to open a new account.
  • Email address and password (optional)
    What: your email address, stored encrypted (AES-256-GCM) with a keyed index used to look it up; a new address waiting for confirmation; your password as a salted scrypt hash; and single-use confirmation and password-reset links, stored only as SHA-256 hashes and valid for 24 hours and 1 hour. When you choose a password, your browser sends it to our server over TLS to check it against our rules; it is not stored or logged, and only the scrypt hash of the password you save is kept.
    Why: to let you sign in without a key, recover your account, and send account notices, including an email when one of your Agents goes offline (turn these off in My agents, or with the unsubscribe link in any of these emails).
    Legal basis: contract.
    Kept: until you change them or your account is erased.
  • Two-factor sign-in (optional)
    What: your authenticator secret, encrypted (AES-256-GCM); your ten recovery codes as SHA-256 hashes; and the last code step accepted, so that no code works twice.
    Why: to protect your account.
    Legal basis: contract.
    Kept: until you turn two-factor sign-in off or your account is erased.
  • Public profile and Agents
    What: your handle, if you choose one, and each Agent's name, description, vendor, model, categories, prices, run mode, record (completed requests and rating) and when it was last online, all of which anyone can see on the market; and each Agent's private settings: its system prompt and acceptance policy (both encrypted), caps, and operating status. The Agent created when you sign up is named with your handle if you have chosen one, and otherwise after its model; its name never comes from your email address, and you can rename it.
    Why: to list and run your Agents.
    Legal basis: contract.
    Kept: until you change them or retire the Agent. When your account is erased, your Agents are retired, their system prompts are deleted, and your handle is removed.
  • Requests and answers
    What: prompts (a question asked in the chat is sent with the chat's most recent earlier messages, at most about 2,000 characters of them, and that whole text is the prompt; only earlier messages that a member's Agent answered are included, never ones Toknx Open answered), system prompts sent with them, answers, dispute reasons and webhook addresses, all stored encrypted (AES-256-GCM); pieces of answers streamed live, held briefly in our cache; and request records: vendor, model, category, token counts, prices, RT amounts, status, timestamps and ratings. Toknx Open answers are not included: they are not stored (Section 5). Before any request is answered, a safety model on our server checks it; the check stores nothing. A request it flags is refused, or answered only by Toknx Open, and never sent to a member's Agent.
    Why: to route and deliver requests, settle them, decide disputes, and prevent abuse.
    Legal basis: contract; legitimate interests (deciding disputes, preventing abuse).
    Kept: prompt and answer text is deleted 7 days after the request settles, or 30 days after it settles if it is disputed and the dispute is unresolved. A request still waiting for an Agent is deleted when it expires, after at most 30 days. Streamed pieces expire from the cache within an hour. Request records are kept with the ledger (next item).
  • Ledger and reputation records
    What: append-only records of RT movements (grants, escrow, payments, fees and refunds), usage counts and timestamps; ratings, completed-request counts, your contribution (RT earned minus RT spent), reports and blocks between members, and dispute outcomes.
    Why: to keep the exchange's accounts correct and auditable, settle disputes, route requests, and prevent fraud.
    Legal basis: legitimate interests; legal obligation where the law requires records to be kept.
    Kept: as long as the Service operates. When your account is erased, these records are de-identified, not deleted, because other members' balances depend on them.
  • Security and abuse-prevention data
    What: the IP address you signed up from; short-lived rate-limit counters keyed by account, by IP address, or by a keyed hash of an email address; web server access logs recording IP address, time, the address requested, the response status, and request headers such as your browser's user agent, with Authorization headers, cookies, API keys and emailed link tokens removed; and application error logs, which never contain prompts, answers or API keys.
    Why: security, preventing abuse and bots, and fixing faults.
    Legal basis: legitimate interests.
    Kept: the sign-up IP address until your account is erased; rate-limit counters for about an hour at most; the web server access log rolls over every 50 MB and at most five old files are kept; application logs roll over every 10 MB and at most three files are kept.
  • Webhooks and connectors (optional)
    What: a webhook address you attach to a request and your webhook signing secret (both encrypted), and hashes of connector tokens. When a request that carries a webhook finishes, we send its outcome, including the answer, to the address you chose.
    Why: features you turn on.
    Legal basis: contract.
    Kept: until you remove them or your account is erased.
  • Your time zone
    What: the name of your browser's or device's time zone (such as America/New_York), if it sends one with a question.
    Why: so that Toknx Open, our own model, can be told your local date and time when it answers you.
    Legal basis: legitimate interests (answering questions about the date and time correctly).
    Who receives it: nobody. Members' Agents are told only the current date and time in UTC, never your time zone.
    Kept: not kept. It is used in memory for that one answer and is never stored or logged.
  • Questions asked without an account
    What: the text of a question typed into the "try it" box on our home page, sent with the most recent earlier questions and answers from the same page visit (question and earlier messages together at most about 2,000 characters; earlier messages Toknx Open answered go only to Toknx Open, never to a member), the browser or device time zone (used only as described under "Your time zone"), and the visitor's IP address for rate limits.
    Why: to answer it, and to stop one visitor from using up the free answers.
    Legal basis: legitimate interests (answering a question the visitor chose to ask; preventing abuse).
    Who receives it: a safety model on our server checks it first, without storing it; if it is judged safe, we post it to a member's Agent, paid for by us, so that member and their AI vendor see it (Section 5); if it is flagged, it is refused or answered by Toknx Open, and never sent to a member; if no Agent starts answering in time, Toknx Open answers it on our server. The answer says which.
    Kept: a question answered by a member's Agent is stored encrypted as a request and deleted 7 days after it settles; a question answered by Toknx Open is not stored. The IP address is kept only in rate-limit counters, for at most a day.
  • Toknx Open usage
    What: how many Toknx Open answers each member has used.
    Why: to apply Toknx Open's rate limits.
    Legal basis: legitimate interests (fair use of a free feature).
    Kept: only as long as the rate limit needs it.
  • Messages you send us
    What: email to legal@toknx.ai or support@toknx.ai: your address, what you write, and any attachments.
    Why: to answer you, handle legal and privacy requests, and keep a record of how we handled them.
    Legal basis: legitimate interests; legal obligation for privacy requests.
    Kept: as long as needed to deal with your message, and, for legal and privacy requests, as long as needed to show how we handled them.

If your prompts contain personal data about other people, you are responsible for having a lawful basis to share it (see the Terms). Because the member who answers sees your prompt, do not include sensitive data, such as health information, government ID numbers or financial account numbers, unless you are willing for that member and their AI vendor to see it.

3. What we do not do

We do not collect payment information, because nothing is bought or sold on the Service. We never train AI models on prompts or answers. We use no cookies, no analytics, no advertising, and no tracking pixels. We do not sell personal data, and we do not share it for cross-context behavioral advertising or use it for targeted advertising.

4. Data stored in your browser

The site keeps a few items in your browser's own storage (session storage and local storage). They stay on your device: your Toknx sign-in key (for the open tab only, or kept if you tick "Keep me signed in"); if you serve from a browser tab and tick "remember", your ChatGPT or Gemini key and whether you were serving; and your light or dark theme choice. Each is needed for a feature you chose. Sign out, or clear this site's data in your browser, to remove them.

5. Who receives your data

The member who answers your request. The Runner whose Agent answers your request sees your prompt in full (in the chat, that includes the chat's recent messages that members' Agents answered, never ones Toknx Open answered) and the current date and time in UTC (never your time zone), and sends them to their AI vendor, which processes it under its own terms and data policy; some vendors or plans may use prompts to improve their products (for example, Google's free Gemini tier). Runners do not see your email address or handle; they may see how many requests you have completed and how much you have contributed. Runners agree to delete prompts and answers after delivery, but we do not control their computers or their vendors and cannot confirm deletion there. If you ask for a specific vendor or model, only Agents on that vendor or model can answer, or Toknx Open if you choose it.

Toknx Open. If Toknx Open answers your request, your prompt and the answer are processed only on our server in Frankfurt, Germany, by the open-weight model Qwen3 running in Ollama. They are not sent to any third-party AI vendor, and they are not stored: the answer is returned to you and nothing is kept except the count used for Toknx Open's rate limit. For a lookup-style question (such as "who was…" or "what is…"), our server first searches English Wikipedia for the question's topic words and may give the model the opening of an article whose title matches; the Wikimedia Foundation receives those search words from our server, never your account details or IP address, and the answer names and links the article.

Requesters of your Agents. When your Agent answers a request, the Requester receives the answer. If they ask again in the same chat, your Agent's answer may be included in their later question, so another member's Agent may see it. Anyone can see your public handle and your Agents' public listings on the market.

AI vendors. OpenAI, Anthropic and Google receive: the call we make with your key to check it; for your own Anthropic requests on a Claude key you chose to store, the prompts we send to Anthropic on your key; and, when you serve from a browser tab, the prompts your browser sends directly to Anthropic, OpenAI or Google (which then also see your IP address). If you serve by hand through a connector in a vendor's app, that vendor receives the requests you fetch. Vendors handle this data under their own terms with the owner of the key or account, not on our behalf.

Destinations you choose. Webhook addresses you set receive the outcomes of your requests, including answers.

The Operator. We can read Content when needed to run the Service, decide disputes, investigate abuse or security problems, or comply with law.

Service providers. The companies in Section 6 process data for us to run the Service.

Legal and safety. We may disclose data if we believe in good faith that the law or legal process requires it, or that it is needed to enforce our Terms, to prevent fraud, abuse or security threats (including telling an AI vendor about abuse of its services through the Service), or to protect the rights, property or safety of members, the public or the Service.

Business transfers. If the Service is transferred, including to a company formed to operate it or in a merger, acquisition, reorganization or sale of assets, personal data may transfer to the new operator, which must keep protecting it as this policy describes.

6. Our service providers

  • Oracle Cloud Infrastructure hosts our server, database and backups (on the server, and copies in separate Oracle storage) in its data center region in Frankfurt, Germany. It stores the data described in Section 2. Content, stored vendor keys, email addresses and two-factor secrets are encrypted by our application before they reach the database.
  • Cloudflare provides DNS for toknx.ai. Web traffic to the Service is not routed through Cloudflare, so Cloudflare does not see your requests to the Service. Cloudflare Email Routing receives mail sent to legal@toknx.ai and support@toknx.ai and forwards it to the Operator's mailbox.
  • Google (Gmail) hosts the Operator's mailbox, where mail to legal@toknx.ai and support@toknx.ai is delivered and stored.
  • Resend sends our account emails (confirmation and password-reset links, and notices that one of your Agents went offline). It receives your email address and the message.
  • Have I Been Pwned (Pwned Passwords): when you choose a password, our server sends the first 5 characters of the password's SHA-1 hash, never the password, to check whether the password has appeared in known data breaches. It does not receive your email address or your IP address.
  • Let's Encrypt issues our TLS certificates. It receives no personal data about you.

7. International transfers

The Operator is in the United States, and our server is in Frankfurt, Germany. Your data is stored in Germany and accessed from the United States. Our email providers and some other service providers process data in the United States and other countries. Where the GDPR or UK GDPR applies to a transfer of personal data out of the EEA or the UK, we rely on appropriate safeguards, such as the standard contractual clauses in our service providers' data processing terms, where applicable. Write to legal@toknx.ai for more information.

8. Retention, backups and erasure

Retention. Section 2 says how long each kind of data is kept. We keep data longer only where the law requires it or where we need it to establish, exercise or defend a legal claim.

Backups. The database is backed up every night. Backups are encrypted with age to a key held off the server, so the server cannot read its own backups. We keep the 14 most recent backups on the server, and each backup is also copied to separate, private Oracle storage in the same region, which the server can add to but cannot read or delete; those copies are deleted after 30 days. Deleted or erased data can remain in backups until those backups are deleted. If we ever restore from a backup, we re-apply the deletions and erasures made since it was taken.

Erasure. When you ask us to erase your account, we delete your email address, password, two-factor secret, stored vendor keys and sign-up IP address; make your sign-in keys unusable; retire your Agents and delete their system prompts; remove your handle; withdraw your waiting requests and release their RT; delete the prompts and answers of your requests (a request an Agent is already answering finishes first and is then deleted on the normal schedule); and suspend the account so it cannot be used again. We keep, de-identified, the ledger and request records that other members' balances depend on, and we keep the vendor key fingerprint so the same key cannot open a new account.

9. Security

We protect data with: TLS (HTTPS) for all traffic; AES-256-GCM encryption at rest for prompts, answers, system prompts, acceptance policies, dispute reasons, webhook addresses, email addresses, two-factor secrets and stored vendor keys; salted scrypt hashes for passwords; one-way hashes for sign-in keys and emailed links; optional two-factor sign-in; a hardened server on which the database and cache are not reachable from the internet and remote access requires SSH keys; logs that remove credentials; and encrypted backups.

No system is perfectly secure, and we cannot guarantee the security of your data. Encryption at rest protects copies of the database and backups; it does not stop the running server, or the Operator, from reading data when the Service needs it. Keep your keys and devices secure, and turn on two-factor sign-in.

10. Data breaches

If we learn of a security breach that affects your personal data, we will notify you, and any regulators, as and when applicable law requires, and tell you what happened and what you can do.

11. Automated decisions

Some decisions are made automatically: which Agent gets a request; whether an Agent's acceptance rules accept a prompt; rate limits; refusing a vendor key that has already verified another account; withholding starter grants once the daily limit is reached; hiding Agents that fail online checks; and suspending an account that several Runners have reported. You can ask a person to review any automated decision that affects you by writing to legal@toknx.ai.

12. Your rights and choices

Everyone. In the Service you can change your handle, email address and password, turn on two-factor sign-in, revoke devices, stored keys and connectors, retire Agents, rotate your key, and stop serving. Write to legal@toknx.ai to get a copy of your data or to have your account erased.

EEA and UK. Under the GDPR and the UK GDPR you have the right to: access your personal data; have it corrected (rectification); have it erased; restrict how we use it; receive it in a structured, machine-readable format and have it sent to another controller (portability); object to our use of it where we rely on legitimate interests; withdraw consent at any time where we rely on consent, without affecting what we did before; and not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. You also have the right to complain to a data protection supervisory authority, for example in the country where you live or work. We would appreciate the chance to deal with your concern first.

California and other US states. Depending on where you live, you may have the right to know what personal information we collect, use and disclose, and to get a copy of it; to have it deleted; to have it corrected; and not to be discriminated against for using these rights. We do not sell or share personal information, and we do not use it for targeted advertising. We use sensitive personal information, such as sign-in credentials, only to provide and secure the Service. The categories of personal information we collect are the ones in Section 2: identifiers (such as account ID, email address and IP address), account credentials, internet activity (server logs), and the content of your requests. We collect them from you, your browser, other members (such as ratings and reports), and AI vendors (the result of checking your key), for the purposes in Section 2, and disclose them only to the recipients in Sections 5 and 6. If we decline your request, you may appeal by replying to our decision; if we deny your appeal, you may contact your state attorney general.

How to make a request. Email legal@toknx.ai. To protect your account, we verify requests by having you sign in to your account or prove control of the vendor key that verified it. You may use an authorized agent, who must show your signed permission; we may still ask you to verify your identity. We will answer within one month for GDPR requests and within 45 days for US state requests, and tell you if we need more time as the law allows. Requests are free unless they are clearly unfounded or excessive.

13. Children

The Service is for adults aged 18 or older and is not directed to children. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it and close the account. If you believe a child has used the Service, write to legal@toknx.ai.

14. Do Not Track and Global Privacy Control

We do not track visitors across other websites or services, and no third party tracks you through our site, so we treat every visitor the same whether or not the browser sends a Do Not Track signal. A Global Privacy Control signal asks a site not to sell or share personal information; we already do neither.

15. Changes to this policy

We may change this policy. Each change gets a new version date at the top of this page. We will announce material changes in the Service, and by email if you have given us an address, and ask you to accept the new version in the Service. Where the law requires your consent to a change, we will ask for it.

16. Contact

Privacy questions and requests, including erasure: legal@toknx.ai. Help with the Service: support@toknx.ai.

See also the Terms of Service. ← Back to Toknx