Privacy Policy

Account information

Sign-in is handled by our authentication provider, Clerk. When you create an account we receive your name, email address, and, if you choose to sign in with Google, the basic profile information Google shares (name, email address, and profile picture). We keep a copy of your name, email address, and account role in our own database to run your account. We never receive your Google password.

API keys

When you create an API key we store it in hashed form together with its settings (name, budget, allowed models, and expiry). The full key is shown to you when it is created. For convenience, the dashboard may keep a copy of a newly created key in your own browser's local storage on that device; that copy is not sent to us.

Usage and request metadata

For every API request routed through Sobat Router we record metadata needed for billing, limits, and your usage dashboard:

• date and time, model requested, and the API key used;
• token counts (input, output, and cached tokens), cost, latency, and status or error information;
• the IP address the request came from.

Content of your requests

Two exceptions: files you upload through a file or media upload endpoint (where available) are stored for as long as needed to process the requests that use them, and error messages returned by providers may be kept with the failed request's log entry. The upstream AI providers that process your requests handle content under their own terms and privacy policies (see "How we share information").

Payments

When you top up tokens we record the order: the package, amount, a unique payment code, the payment transaction reference, status, and timestamps. Payment is completed in your own e-wallet or banking app by scanning a QRIS code processed through GoPay. We do not receive or store your card number, bank account credentials, or e-wallet login.

Technical and security information

When you use the website or dashboard, our servers log standard technical information such as your IP address, browser user agent, pages requested, and time of access. We also record the IP address and time you last used the dashboard, and may derive an approximate location (country, region, city, and network provider) from IP addresses using an IP geolocation service. We use this to keep accounts secure and to prevent fraud and abuse.

Support communications

If you contact us by email, WhatsApp, or Telegram, we receive the information you share with us, such as your contact details and the content of your messages.

We use the information above only to:

• create your account, sign you in, and keep your session secure;
• route your API requests to the model provider you choose and return the responses;
• meter usage, deduct your token balance, enforce key budgets and limits, and show your usage and logs;
• process top-ups and keep billing records;
• detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms;
• provide support and send important service or account messages;
• operate and improve the service using aggregated statistics (for example, average model speed shown in the catalog) that do not identify you;
• comply with legal obligations.

We do not sell your personal information, and we do not use it for advertising. We do not use the content of your requests to train AI models.

If you choose "Sign in with Google", the following applies to the data we receive from Google:

• What we access: only your basic profile information (name and profile picture) and your email address, through Google Sign-In. We do not request access to your Gmail, Google Drive, Contacts, Calendar, or any other Google service.
• How we use it: only to create your Sobat Router account, sign you in, identify your account, and contact you about it.
• Sharing: we do not sell Google user data, do not use or transfer it for advertising, and do not share it with third parties except our authentication provider (Clerk), which processes it on our behalf to provide sign-in, or where required by law.
• AI models: we do not use Google user data to develop, improve, or train generalized AI or machine learning models.
• Retention and deletion: we keep this data while your account exists and delete it when you ask us to delete your account. You can also remove Sobat Router's access at any time from your Google Account settings.

We share information only with service providers that help us run Sobat Router, and only as needed:

• Authentication (Clerk): stores your account and sign-in details and manages your session.
• AI model providers: the content of each request (prompts, messages, files, and parameters) is sent to the third-party provider or upstream service that serves the model you select, so it can generate a response. We send a pseudonymous identifier derived from your API key instead of your name or email. These providers process content under their own terms and privacy policies, which may include temporary retention for abuse monitoring.
• Payments (GoPay / QRIS): processes your top-up payment. Your bank or e-wallet provider also processes the payment under its own terms.
• Hosting and infrastructure: our servers, databases, and backups run on cloud infrastructure providers.
• IP geolocation: IP addresses may be sent to an IP geolocation service (ip-api.com) to estimate approximate location for security purposes.

We may also disclose information if required by law or a valid legal request, to protect the rights, safety, and security of Sobat Router, our users, or others, or as part of a merger, acquisition, or sale of assets (in which case this policy will continue to apply to your information).

We use only cookies and browser storage that the site needs to work:

• Session cookies set by Clerk to keep you signed in and protect your account;
• a language cookie that remembers your chosen language;
• local storage for your theme preference (light or dark) and, if you use it, copies of API keys you created on that device.

We do not use advertising cookies or third-party analytics trackers.

We keep account information, API key records, usage records, and billing history for as long as your account is active, so you can see your history and we can bill accurately. When you ask us to delete your account, we delete or anonymize your personal information within a reasonable time, except records we must keep to comply with legal, tax, or accounting obligations, resolve disputes, or prevent fraud and abuse. Server logs are kept for a limited period for security and troubleshooting.

We protect your information with measures such as encrypted HTTPS connections, hashed API keys, encrypted storage of provider credentials, restricted network access to our databases, and limited administrative access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your API keys secret and revoke any key you believe has been exposed.

Subject to applicable law, including Indonesia's Personal Data Protection Law (UU PDP), you can ask to access, correct, update, export, or delete your personal information, or withdraw your consent. You can:

• update your profile through the account menu in the dashboard;
• revoke API keys at any time from the API Keys page;
• request a copy of your data or deletion of your account by emailing support@sobatnetwork.com from the email address on your account;
• disconnect Google Sign-In from your Google Account settings.

We will respond within a reasonable time and may need to verify your identity before acting on a request.

Sobat Router is operated from Indonesia. Some of our service providers, including authentication, AI model providers, and infrastructure providers, may process information in other countries. When we transfer information we take reasonable steps to ensure it remains protected in line with this policy and applicable law.

Sobat Router is a developer service and is not directed to children. You must be at least 18 years old (or the age of majority where you live) to use it. We do not knowingly collect personal information from children under 13; if you believe a child has given us personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will change the "Last updated" date above and, for material changes, notify you by email or through the dashboard before the changes take effect. Continuing to use Sobat Router after an update means you accept the updated policy.

If you have questions or requests about this Privacy Policy or your data, email us at support@sobatnetwork.com. Sobat Router can be found at https://sobatnetwork.com.