Privacy Policy

This policy covers the bayar.dev website and its public API endpoint POST /api/chat, operated by Namchinbayar Naran, doing business as BAYAR DEV (“bayar.dev”), located in Walnut Creek, California (“we”). It does not cover private or self-hosted deployments running inside a customer's own cloud account, which are governed by the agreement for that engagement — see Private Deployments.

We do not retain the content of your interactions. Prompts you submit and the responses streamed back exist in server memory only for the duration of the request and are discarded when it completes. There is no conversation database, no transcript archive, and no export of your prompts to any analytics or training system operated by us.

The conversation you see in the terminal lives in your browser's memory. Reloading the page destroys it permanently — we hold no copy to restore. Because the endpoint is stateless, your client replays the conversation on each turn; we do not reconstruct it from storage.

We do not use your prompts or the model's responses to train or fine-tune any model.

Rate-limit counters store a request count against an IP-derived key with a short expiry. They contain no prompt content, and the counter is deleted when its window elapses.

• No accounts, passwords, or user profiles — the demo requires no signup.
• No analytics, tracking pixels, session recording, or advertising networks.
• No tracking or advertising cookies, and no cross-site identifiers.
• No third-party client-side scripts loaded into the page.
• No payment or financial data — nothing is sold through this site.
• No sale, rental, or sharing of any data with data brokers.

We do not ask for special-category personal data and ask that you do not submit it — or any confidential, regulated, or personally identifying information about yourself or others — into the public demo terminal. It is a public, unauthenticated endpoint and should be treated as such.

Three boundaries are enforced in the request path:

• Input boundary. Requests are validated against a strict schema before any upstream call. Only text content is forwarded; message roles are restricted so a client cannot inject system instructions.
• Context boundary. Only the most recent portion of a conversation is sent upstream — a hard cap of 20 messages and 12,000 characters. Older turns are dropped, not stored.
• Output boundary. Upstream errors are logged server-side and replaced with a generic message before they reach you, so provider identity, hostnames, and stack traces are not exposed on the wire.

The technical detail behind each boundary is published in the API documentation.

We do not add a subprocessor that receives prompt content without updating this page. A current list, including the processing region for inference, is available on request for vendor reviews and security questionnaires.

• All traffic is served over HTTPS. Plain HTTP requests are redirected; there is no unencrypted path to the API.
• Transport is TLS 1.2 or higher, terminated at the hosting provider's edge. Traffic between the edge and the origin route, and between the route and the model provider, is encrypted in transit.
• Responses stream over server-sent events on the same connection as the request. Nothing is written to disk at the edge to assemble a response.
• Prompt content is not cached at the edge. Static assets are cached and contain no user data.
• Requests may transit an edge point of presence near you before reaching the origin. Edge nodes see connection metadata and the encrypted request; they do not retain the request body.

In a private deployment, the gateway runs inside the customer's own cloud account and reaches a customer-owned model deployment over a private endpoint. In that topology prompt and completion data does not enter infrastructure operated by bayar.dev at all, and encryption keys remain under customer control. The topology is documented under VPC & BYOK; the binding data terms are those in the engagement agreement, not this page.

Depending on where you live, you may have rights to access, correct, delete, or restrict processing of your personal data, and to object to it or lodge a complaint with a supervisory authority.

In practice there is very little to exercise them against: we hold no account for you and retain no conversation history. Requests about server logs or email correspondence can be sent to hi@bayar.dev and are answered within 30 days. We may need to verify your identity before acting on a request, and cannot delete data we never held.

Our basis for processing the limited technical data described above is our legitimate interest in operating and protecting a public service. Prompt content is processed to perform the action you requested.

Credentials for the model provider are held in server-side environment variables, are never exposed to the browser, and are not included in error responses. The endpoint enforces request validation, payload size caps, and per-identity rate limits so a single caller cannot exhaust the service. No system is immune to compromise; report a suspected vulnerability to hi@bayar.dev and we will respond directly.

This service is intended for business use and is not directed at children under 16. We do not knowingly process personal data of children.

Material changes are reflected in the “Last updated” date at the top of this page. Continued use of the site after a change constitutes acceptance of the updated policy.

Privacy questions, data requests, and vendor security reviews: hi@bayar.dev. The controller for the processing described here is Namchinbayar Naran, doing business as BAYAR DEV (“bayar.dev”), located in Walnut Creek, California; see About for verified identity details.