Legal

Privacy Policy

What Ninetile collects when you use the site, the dashboard and the API, and what we do with it.

Last updated 4 November 2026

What we collect
Why we collect it
Challenge data
Who sees it
How long we keep it
Your rights
Cookies
Contact

1. What we collect

Account details

Your email address and display name, taken from the Google account you sign in with. We never receive or store your Google password. We store an internal account ID, and the balance and credit history attached to it.

API keys

Keys are stored as a hash, never in a form that can be read back. We also store the key’s permissions, spend limit, an optional IP allow-list, and the last IP address a key was used from.

Usage records

For each request: the time, the endpoint, the target site hostname, whether it succeeded, the error code if it failed, the latency, the amount charged, and the puzzle family when we can tell. For recognitions we also keep the prompt text and the answer we returned.

Technical data

The IP address you call us from, the user agent of your API client, and ordinary server logs. The IP address is used for abuse prevention and rate limiting and is kept with the request record.

Payment data

If you top up with crypto through our payment provider, we receive the payment status, the amount and a transaction reference. We do not receive or store card numbers, wallet private keys or seed phrases.

2. Why we collect it

To run the service — authenticate you, route your request, return the answer.
To bill you accurately — the ledger of charges and holds is how your balance works.
To keep it working — error codes and latency let us see what is broken.
To prevent abuse — rate limits, fraud checks and suspension of abusive accounts.
To answer you — replying to a support request, or telling you about a change that affects your account.

We do not use your data to build advertising profiles, and we do not sell it.

3. Challenge data and how we handle it

When you send a recognition request, the images of the challenge pass through our infrastructure on the way to the model that answers it. They are not attached to your account history.

We do keep the prompt text and the answer we returned, because that is how you and we can both see what was solved and what was charged. We do not publish your requests, and we do not sell them.

Training. A challenge your request failed on may be retained to improve the solver. Frames kept for that purpose are stored under an internal identifier rather than your account, and they are used only to train and test our own models.

We share data only where it is needed to run the service:

Infrastructure providers — the cloud hosts running the API, the models and the backups.
Cloudflare — hosting the site, and the network in front of the API.
Google — as the sign-in provider, which authenticates you independently of us.
Residential proxy providers — your request travels through a proxy exit IP. The provider relays traffic and does not receive your identity from us.
Payment provider — for crypto top-ups only.
Where the law requires it — a valid legal request, or to defend a legal claim.

We do not otherwise disclose your data to third parties.

5. How long we keep it

Usage records, request history and the balance ledger are kept while your account is open, because they are your invoice history. Backups are taken frequently and rotated; a deleted record can persist in a backup for a short period before that backup expires.

If you close your account, we delete your account details and keys and detach your request history. We may keep aggregate counts that no longer identify you, and we keep what the law requires us to keep.

6. Your rights

Depending on where you live, you may have the right to see the data we hold about you, correct it, delete it, restrict how we use it, or receive a copy in a portable format. You can also object to processing based on legitimate interests.

To exercise any of these, write to support@ninetile.io from the address on your account. We answer within 30 days. If you are in the EEA or UK you may also complain to your local supervisory authority.

We process data to perform our contract with you, to comply with legal obligations, and on the basis of legitimate interests in keeping the service secure and working.

7. Cookies and local storage

We use a small number of cookies that the service cannot work without:

Session cookie — keeps you signed in to the dashboard. HttpOnly, SameSite=Strict, Secure, and it expires.
Cloudflare — security and bot-protection cookies set by the network in front of the site.
Theme preference — stores light or dark mode on your device.

We do not run advertising or cross-site tracking cookies, and we do not embed third-party analytics that profile you.

8. Children

The service is not intended for anyone under 18, and we do not knowingly collect data from children.

9. Contact

Questions about this policy, or a request about your data: support@ninetile.io. See also our Terms of Service and Refund Policy.

Note. This policy describes the data the service actually handles today. It is a template, not legal advice; have a lawyer in your jurisdiction review it before you rely on it.