model.do

Privacy, verifiable

Last updated: July 2026 · Versión en español

We don't ask you to trust us — we tell you exactly what happens to every byte, and how to check it yourself.

What leaves your browser

DataDestinationWhy
Your message and the current conversation historymodel.do API → Hugging Face Inference Providers; OpenRouter only if fallback is neededIt's what the model needs to answer
In Debate mode: the question, both generated answers and both cross-examinationsThe selected model providers and the independent arbiter's providerEach participant must inspect the other answer, and the arbiter must inspect the complete debate. Generated model text is therefore transmitted again as quoted material
Your IP addressHosting/CDN infrastructure; model.do uses a salted hash in process memoryNetwork delivery, access logs and abuse rate-limiting. The application never writes the IP into its metrics file
Anonymous pass, if you enter onemodel.do API onlyValidate Debate access. The raw pass is not logged or sent to model providers
Anonymous product eventmodel.do APIDaily aggregate counts for page loads, completed chats, modes, model IDs and Blind Arena votes. Never conversation content

What we store on our servers

No conversation content or visitor profiles. There is no conversation database or response cache. When private insights are enabled, model.do stores daily aggregate counters: country code when supplied by the network, mode, expert, model IDs, provider, outcome, duration, Blind Arena vote, Debate completion and optional helpful/not-helpful rating. It never stores your message, answer, raw IP, user agent, session ID or a persistent visitor identifier. Hosting/CDN access logs are separate infrastructure records and may contain IP and request metadata.

Where your history lives

On your device, and only if you turn it on. By default the conversation exists only in the tab's memory — close it and it's gone. If you enable "Save on this device", your browser's local storage is used. "Destroy conversation" wipes both instantly. If you activate an anonymous Debate pass, that token is stored separately in this browser so it remains usable after a reload; removing site data removes it.

Debate quota and passes

The free daily Debate quota uses an IP-derived key salted with a new random secret on every server restart. The key exists only in process memory, expires with the daily bucket and is never written to analytics. It is an abuse control, not an identity. A pass is either self-expiring and cryptographically signed, or compared as a cryptographic hash. If a payment provider is added, that provider will process the payment under its own privacy terms; model.do still does not require a user account.

The model providers

Here's the honest nuance: we don't store your conversations, but the models run on third-party infrastructure. Hugging Face Inference Providers is the first route; Hugging Face says it does not store request or response bodies while routing, but each underlying inference provider has its own policy. If that route fails before producing text, model.do tries OpenRouter. Every OpenRouter request excludes endpoints marked as collecting prompt data, and the deployment can additionally require zero-data-retention endpoints. See the Hugging Face security notes and OpenRouter's provider policy documentation. That's why we say "privacy without identification", not "total anonymity": your messages travel without an account, a name or a persistent identifier — but they do travel.

How to verify it

  1. Open your browser's developer tools (F12) → Network tab.
  2. Use model.do normally. Every request goes only to model.do and api.model.do. Inspect /api/events: it contains product labels, never your prompt or answer.
  3. Our Content-Security-Policy header makes the browser block any third-party connection — even if we wanted to add a tracker, it wouldn't load.
  4. Application → Cookies tab: zero cookies.

What we don't promise

We don't promise anonymity from your network operator or the upstream providers. A VPN or Tor can hide your network address from model.do, but it does not remove the need to send prompt content to an inference provider. Avoid entering secrets or highly sensitive personal data.