Privacy, verifiable
Last updated: July 2026 · Versión en español
We don't ask you to trust us — we tell you exactly what happens to every byte, and how to check it yourself.
What leaves your browser
| Data | Destination | Why |
|---|---|---|
| Your message and the current conversation history | model.do API → Hugging Face Inference Providers; OpenRouter only if fallback is needed | It's what the model needs to answer |
| In Debate mode: the question, both generated answers and both cross-examinations | The selected model providers and the independent arbiter's provider | Each participant must inspect the other answer, and the arbiter must inspect the complete debate. Generated model text is therefore transmitted again as quoted material |
| Your IP address | Hosting/CDN infrastructure; model.do uses a salted hash in process memory | Network delivery, access logs and abuse rate-limiting. The application never writes the IP into its metrics file |
| Anonymous pass, if you enter one | model.do API only | Validate Debate access. The raw pass is not logged or sent to model providers |
| Anonymous product event | model.do API | Daily aggregate counts for page loads, completed chats, modes, model IDs and Blind Arena votes. Never conversation content |
What we store on our servers
No conversation content or visitor profiles. There is no conversation database or response cache. When private insights are enabled, model.do stores daily aggregate counters: country code when supplied by the network, mode, expert, model IDs, provider, outcome, duration, Blind Arena vote, Debate completion and optional helpful/not-helpful rating. It never stores your message, answer, raw IP, user agent, session ID or a persistent visitor identifier. Hosting/CDN access logs are separate infrastructure records and may contain IP and request metadata.
Where your history lives
On your device, and only if you turn it on. By default the conversation exists only in the tab's memory — close it and it's gone. If you enable "Save on this device", your browser's local storage is used. "Destroy conversation" wipes both instantly. If you activate an anonymous Debate pass, that token is stored separately in this browser so it remains usable after a reload; removing site data removes it.
Debate quota and passes
The free daily Debate quota uses an IP-derived key salted with a new random secret on every server restart. The key exists only in process memory, expires with the daily bucket and is never written to analytics. It is an abuse control, not an identity. A pass is either self-expiring and cryptographically signed, or compared as a cryptographic hash. If a payment provider is added, that provider will process the payment under its own privacy terms; model.do still does not require a user account.
The model providers
Here's the honest nuance: we don't store your conversations, but the models run on third-party infrastructure. Hugging Face Inference Providers is the first route; Hugging Face says it does not store request or response bodies while routing, but each underlying inference provider has its own policy. If that route fails before producing text, model.do tries OpenRouter. Every OpenRouter request excludes endpoints marked as collecting prompt data, and the deployment can additionally require zero-data-retention endpoints. See the Hugging Face security notes and OpenRouter's provider policy documentation. That's why we say "privacy without identification", not "total anonymity": your messages travel without an account, a name or a persistent identifier — but they do travel.
How to verify it
- Open your browser's developer tools (F12) →
Networktab. - Use model.do normally. Every request goes only to
model.doandapi.model.do. Inspect/api/events: it contains product labels, never your prompt or answer. - Our
Content-Security-Policyheader makes the browser block any third-party connection — even if we wanted to add a tracker, it wouldn't load. Application → Cookiestab: zero cookies.
What we don't promise
We don't promise anonymity from your network operator or the upstream providers. A VPN or Tor can hide your network address from model.do, but it does not remove the need to send prompt content to an inference provider. Avoid entering secrets or highly sensitive personal data.