Privacy policy
Updated September 17, 2026. Applies to Token Faucet and clients sharing its accounts.
Account and usage data
We process your email, display name, authentication information, API key hashes, credit ledger, model IDs, request times, status and token usage. A complete API key is shown only when created; keep it secure.
Messages and model providers
Prompts and tool information are sent to upstream model services. Our credit database does not store complete prompts or replies; production gateway body auditing is disabled. Tool continuation state is stored temporarily. Providers apply their own data practices. Do not submit passwords, keys or personal information you are not entitled to share.
Infrastructure and email
Supabase provides authentication and database services, Resend delivers authentication email, Cloudflare proxies traffic and provides protection, and our server processes API calls. Data may be processed outside your region.
Cookies and advertising
Essential cookies maintain login; local storage remembers language. Google and other advertising vendors may use cookies to serve ads based on earlier visits to this and other websites, measure delivery and prevent fraud. Ordinary ad views and clicks do not earn tokens. Manage personalized ads through Google Ad Settings; applicable regions have separate consent choices.
Abuse prevention and device data
To limit bulk registration and repeat claims, we use a necessary device cookie and keyed hashes of IP, network prefix and limited browser characteristics such as language, screen size and time zone. Risk records are retained for up to 90 days and periodically removed. We do not collect canvas images, font lists or cross-site browsing history. Mainland China uses our slider; other regions use Cloudflare Turnstile. These are risk signals, not proof of identity. Contact support to appeal a pending claim.
Retention and account requests
Account and metering records support the service, reconciliation and abuse handling. Operational logs support diagnostics. Third-party retention may differ. Revoke keys and export available usage records in your account; use Contact for account or data requests. We verify ownership before deletion. Backups and necessary security records may not be removed immediately.