Accounts and sign-in
Signing in with Google or GitHub gives our authentication service your provider account identifier, email address and basic profile information, such as your name and profile picture. Google sign-in requests only OpenID, email and profile permissions. It does not request access to Gmail, Drive, contacts or calendars.
Neon Auth manages identity records, linked providers, authentication tokens and sessions. Session cookies keep you signed in. We use sign-in data to authenticate you, manage your account and workspaces, provide account features and prevent abuse. We do not sell Google or GitHub sign-in data, use it for advertising, or use it to train AI models.
Inference and workspace data
We process your requests to run the models you use. Phantom's inference API does not store prompt or completion text. Requests pass to the model provider, which receives the content and applies its own data practices. Do not send content you are not authorized to share with those services.
By default, phantom-1 may route a request to a free model or another available provider. Zero data retention is opt-in: requesting it on a call or in a key's route policy excludes the free model and asks the upstream to use only providers that support zero data retention.
We retain usage metadata, including key hashes, models, token counts, costs and timestamps, plus balances, spending settings and workspace records. Routing can retain a salted hash that identifies a conversation until its routing window expires. Video job records include the result URL, job status and processing metadata. Workspace ownership and account grants can associate keys and usage with your account.
Payments and service providers
Stripe processes card payments and can store billing details and saved payment methods. Phantom keeps payment identifiers, amounts, statuses and links to funded keys or workspaces. Wallet payments can include public wallet addresses and transaction identifiers. Blockchain transactions are public and cannot be erased by Phantom.
We use Neon for authentication and database hosting, Vercel for hosting, website analytics and performance measurements, and Resend for service and support email. Hosting and authentication services can process technical data such as IP addresses, browser information and request logs. Providers receive data needed to deliver their services. We may also disclose records when required by law or to investigate abuse and protect the service.
Retention and your choices
We retain account, billing and usage records to operate the service, preserve purchased credit, prevent fraud and meet legal obligations. These records do not have a single automatic deletion deadline. Expired routing records are cleaned up separately.
The account page shows privacy information and lets you erase application account links. That action removes grants and referrals, detaches workspace ownership, disables automatic reload and ends sessions. It preserves paid keys, credit, billing records, the grant prevention ledger and your Neon Auth identity. It does not fully delete your sign-in identity.
For access, correction or deletion requests, including deletion of your authentication identity, email support@phantom.codes. We may need to verify ownership. Some records must remain for billing, fraud prevention or legal reasons. You can revoke Google or GitHub access in your provider's account settings; revoking access does not itself delete records already held by Phantom.
Changes and contact
Updates will be posted here with a revised effective date. Questions about this policy can be sent to support@phantom.codes.