gm

Privacy Policy

Last updated: 18 August 2026

This policy describes how gm handles request content, account information, usage records, and website analytics. The controller for account, website, and billing data is T34 Corporation FZCO, Dubai World Trade Centre Authority trade licence L-3102, Dubai Unified Licence CN9173, of FZH 097 04, Sheikh Rashid Tower, Dubai World Trade Centre, Dubai, UAE.

This policy covers the gm inference platform: the API gateway buyers send requests to, the dashboard at saygm.com, and the account, billing, and key management behind them. It does not cover the separate Graham Morrow Discord bot, which has its own privacy policy.

Your prompts and completions

A request you send — through the OpenAI, Anthropic, or Gemini-compatible API, or through the dashboard’s chat — is forwarded to the gm gateway, which runs inside an Intel TDX Trusted Execution Environment (TEE). The gateway’s design is meant to keep request and response content decrypted only inside that enclave, so it is not visible in plaintext to gm or to the miner operators whose machines forward it. This is an attested claim, not just a stated one: the enclave publishes a quote that both buyers and the network’s validators can verify independently, rather than taking gm’s word for it.

If you turn on guardrails for an API key — content scanners that redact personal data, secrets, or your own custom rules before a request leaves the enclave — that redaction also happens inside the TEE, and round-trippable redactions (like PII) are restored in the reply the same way. What gets logged about that process is counts only: how many emails or API keys were caught, per scanner, never the matched values or the surrounding text. The code that builds this log has regression tests that check matched values and provider error text do not enter the stored record.

After any guardrail step, your request content is sent to the model and infrastructure providers selected for that route. These currently include Anthropic, OpenAI, Google, Chutes, Z.ai, Moonshot, DeepInfra, and KubeTEE. Depending on the route, a provider may process content on gm’s instructions or under terms that apply directly to its service. Routes and providers can change; gm remains responsible for explaining how the gm service selects and uses them.

The gateway writes a matching pair of records for each serving attempt. If a request is retried against another miner, it can produce more than one pair; every attempt shares the same request id so the sequence can be audited:

• A settlement record, used to pay the miner that served your request and to audit the subnet’s economics. It carries no buyer identity at all — no account id, no API key id, no IP address — only a gateway id, the miner and product/model served, token counts, price, a timestamp, and whether the request succeeded. Once the network epoch it belongs to closes, this record is written to object storage as public, permanently readable data — that is by design, not a mistake: it is how the subnet proves its own accounting.
• A diagnostic record, kept for 30 days in storage gm controls (not public), used for support and debugging. It holds things like latency, retry counts, an error class, and the guardrail activity counts described above — but, like the settlement record, never your prompt, completion, or provider-supplied error text.

The TEE description above does not extend to a provider’s handling after content reaches it, anything logged by your own client before it reaches gm, or the metadata itself — model id, timestamps, token counts, and error class — which the gateway deliberately reads and records to run billing, settlement, and support.

Usage and billing

Accounts, API keys, and billing are managed by a separate internal service (referred to in this policy as the account service) shared across the team’s products. For each API key, it keeps an aggregated usage record per billing period — request counts, tokens or compute-units consumed, error counts — broken down by provider and model, but never prompt or response content.

Card payments are processed by Stripe: gm stores your Stripe customer id and invoice records, never your card number. On-chain USDC top-ups are tracked against your account together with the paying wallet address.

Account, usage, and billing data does not currently have a fixed automatic deletion period. It is kept while your account is active and afterwards where reasonably necessary for accounting, security, dispute resolution, enforcing agreements, and legal obligations. Diagnostic records are kept for 30 days. Public settlement records are permanently readable by design, as described above. You can ask us to close your account or delete eligible information using the contact details below.

Why we use personal data

Depending on the context, we process personal data because:

• it is needed to provide the Service and perform our agreement with you;
• it is in our legitimate interests to secure, support, improve, and account for the Service, where those interests are not overridden by your rights;
• you consent to optional analytics or product-update email, which you can withdraw at any time; or
• we need to comply with law or establish, exercise, or defend legal claims.

When a business customer submits personal data through the API for us to process on its instructions, that customer may be the controller and gm may act as its processor or service provider. The customer remains responsible for its notices, lawful basis, and instructions.

Accounts, sessions, and API keys

Signing in is passwordless: an email magic link, “Continue with Google”, or “Continue with Bittensor” wallet login. There is no separate signup — the first time you use any of those, it creates your account.

Once signed in, your session is held in an encrypted cookie your browser’s JavaScript cannot read, for 30 days. A second, non-secret cookie just records that you are signed in, so the page can show that without touching the encrypted one.

API keys you create are managed by the account service; gm’s dashboard shows you a key’s secret value once, at creation, and does not store it afterwards. You can revoke a key at any time from the dashboard. The dashboard’s own built-in chat feature mints one additional key on your behalf so it can call the gateway for you; that key is encrypted at rest and is never shown to you or retrievable in plaintext.

Cookies

• gm_session — 30 days, not readable by page scripts — your signed-in session, encrypted.
• gm_logged_in— 30 days, readable by the page — lets the interface show you’re signed in without exposing the session cookie.
• A handful of short-lived cookies used only during the few seconds of a Google or Bittensor sign-in redirect, cleared once it completes.
• _ga and related Google Analytics cookies — production only, when Analytics is configured and after you accept analytics cookies — see below.
• Cloudflare (on sign-in, account creation, invite, and waitlist forms) and Stripe (on the payment form) may each set their own cookies under their own domains when those widgets load; gm does not read or control those.
• Your light/dark theme preference is remembered in your browser’s local storage, not a cookie.

Analytics

If you accept, gm uses Google Analytics 4 across the website to understand traffic — pages viewed, rough location, device, and browser. This includes dashboard and chat page views, but gm does not send your prompts, completions, or other chat message text to Google as analytics events. Analytics does not load before you choose “Accept analytics”. You can reject it or withdraw consent at any time using the persistent Cookie settings control.

Product updates

If you ask to receive product updates, gm records the email address, the wording/version of the consent you confirmed, and the dates you granted or withdrew it. The initial choice is optional and unchecked. We send a separate confirmation email before adding the address to the marketing list, and signing in does not depend on accepting.

You can unsubscribe from Account or from a link in an email at any time. Withdrawing consent stops future marketing and records the withdrawal so the address is not silently re-added. Account, billing, security, and service messages are not marketing and may still be sent when necessary.

Other third parties

• Stripe — card payments. Receives your card and billing details directly; gm never sees your card number. See Stripe’s privacy policy.
• Cloudflare Turnstile — a bot-check widget on email sign-in and account creation, invite, and waitlist forms. Cloudflare receives browser and network information needed to assess whether the request is automated. See Cloudflare’s privacy policy.
• Google Analytics — see Analytics above. See Google’s privacy policy.
• SendX— delivers product-update email only after confirmation and keeps delivery, unsubscribe, bounce, and suppression status in sync with gm’s consent record. See SendX’s privacy policy.
• Model and infrastructure providers — the providers named above receive request content only when selected for its route. Their handling and any downstream provider exceptions depend on that route. For example, see DeepInfra’s data handling and Anthropic’s privacy notice.
• Object storage — holds the public settlement records described above, and separately, public blog images. Neither holds prompt or response content.

International transfers

gm is based in Dubai, and providers may process data in the United States and other countries outside your own. The safeguards that apply depend on the provider and route. Contact us for current information about a route’s processing locations and any transfer protections relevant to your data.

Your choices

• Revoke or recreate any API key from the dashboard at any time.
• Turn a key’s guardrails on or off, or edit their rules, from the dashboard.
• Manage or withdraw product-update consent from the Account page at any time.
• Ask us to close your account or handle a data request by emailing [email protected]. There is not currently a self-serve account-deletion flow.

Depending on the law that applies to you, you may ask to access, correct, delete, restrict, or receive a portable copy of your personal data, object to certain processing, or withdraw consent. You may also complain to the UAE Data Office or the data-protection authority where you live or work. We may need to verify your identity, and some rights have legal exceptions. We do not use your account data to make solely automated decisions that produce legal or similarly significant effects.

Children

gm is not directed at children.

Changes

We may update this policy; material changes will be reflected by the “Last updated” date above.

Contact

T34 Corporation FZCO, FZH 097 04, Sheikh Rashid Tower, Dubai World Trade Centre, Dubai, UAE. Email [email protected] for privacy questions or data requests. Website: saygm.com.