Privacy Policy

1. The short version

Infernet is designed so the control plane sees as little of your inference traffic as possible. Prompts and outputs flow client ↔ operator over SSE; we don't persist them by default. The infernet CLI authenticates with a Nostr keypair and a HMAC-signed JWT — operators never hand us a database credential.

2. What we collect

• Account email + Supabase auth metadata — when you sign up via the dashboard, we store your email and a hashed password through Supabase Auth. Used for sign-in, password reset, and operational notices.
• Operator identity (public) — your Nostr public key, advertised endpoints, and self-reported hardware capabilities. This is public network state, by design.
• Job metadata — job ID, model, status, payment offer, and routing decisions. We do not store the prompts or completions of jobs you submit through the network.
• Operational logs — request paths, status codes, latency, IP for rate-limiting and abuse mitigation. Retained 30 days.

3. What we don't collect

• Prompts, completions, embeddings, or training data submitted to the network.
• Wallet seed phrases or private keys. Wallets are non-custodial; we don't hold the keys.
• Third-party advertising or marketing trackers — the site has no ads.
• Cross-site tracking cookies. We use only the session cookie required for sign-in.

4. Subprocessors

We use the following providers to run the service:

• Supabase — Auth, Postgres, file storage.
• Resend — transactional email (sign-up confirmation, password reset).
• Railway — application hosting.
• CoinPayPortal — non-custodial payment processing for job settlement.

Each subprocessor only receives the minimum data needed to do their job. We don't share your data with third parties for advertising or analytics.

5. Cookies

We use a single first-party session cookie (set by @supabase/ssr) to keep you signed in. No analytics cookies, no third-party tracking pixels.

6. Your rights

You can delete your account at any time from the dashboard or by emailing hello@infernetprotocol.com. Account deletion removes your email, hashed password, and any account-linked metadata. Public network state advertised by your operator key is, by nature, public — rotate the key to retire an identity.

EU/UK residents: you have the standard GDPR rights of access, rectification, erasure, restriction, portability, and objection. Email us to exercise any of them.

7. Self-hosting

If you self-host the control plane, your deployment is governed by your own privacy policy — this policy applies only to infernetprotocol.com.

8. Contact

Privacy questions or requests: hello@infernetprotocol.com.