Legal

Privacy Policy

Last updated August 21, 2026

Ox provides realtime inference APIs and a developer dashboard. This policy explains the information used to operate those services.

Information we process

When you request or receive developer access, we process your email address, project identity, authentication records, API-key metadata, platform usage, configuration changes, and security audit events. Raw API keys and webhook signing secrets are shown once and stored only in protected or one-way forms.

If you sign in with Google, we receive your verified email address and stable Google account identifier. We request only the openid, email, and profile scopes. Ox does not store Google access tokens or refresh tokens and does not access Gmail, Drive, Calendar, contacts, or other Google services.

How we use information

We use this information to authenticate you, associate you with an approved project, deliver and secure the platform, meter usage, diagnose failures, prevent abuse, and maintain an auditable record of access and configuration changes.

Service providers

Ox uses infrastructure and identity providers, including Google for optional authentication, Vercel for application hosting, and managed data infrastructure for durable account and operational state. Providers process information only as needed to deliver their services to Ox.

Retention and control

We retain account and project records while developer access remains active and retain operational or security records as reasonably needed for reliability, fraud prevention, and legal obligations. You can request access removal or deletion through the API access contact form. Some security, billing, or legal records may be retained when required.

Security

Ox uses encrypted transport, HttpOnly session cookies, short-lived OAuth state, PKCE, signed identity-token verification, rate limits, project isolation, and server-side secret storage. No online system can guarantee absolute security.

Contact

For privacy questions or requests, use the Ox API access form and identify the request as privacy-related.