Privacy Policy
Last updated: 18 October 2026
This policy explains what personal data unrestricted.sh processes, why, and what rights you have.
Who is responsible
unrestricted.sh is the data controller. unrestricted.sh is a personally owned business registered in Denmark.
- CVR number: 41347015
- Address: Stjernepladsen 41, 6. 5., 9000 Aalborg, Denmark
- Email: support@unrestricted.sh
The short version
- We do not save or log your prompts or the model's answers. The GPU server keeps recent context in memory for a short time to answer follow-up requests faster, and never writes it to disk. We never use prompts or completions to train models. The No-Logs Policy says exactly what that covers.
- Playground chat history is kept only in your browser, encrypted. It never reaches our servers.
- We keep what we need to run your account, bill you, and prevent abuse: your email address, sign-in records, payments, and usage records such as token counts.
- We record a small set of account events, such as that you ran out of credit or started a checkout. Never what you wrote.
- We do not sell your data or use advertising trackers.
What we collect and why
| Data | What it includes | Why | Legal basis |
|---|---|---|---|
| Account | Email address, your name if you give one, and if you sign in with Google or GitHub, the account ID, name and email address we keep from that provider | To create your account and sign you in | Contract |
| Sign-in and security | Sign-in sessions with IP address and browser type, the result of the bot check at sign-in | To keep accounts secure and prevent abuse | Legitimate interests |
| Welcome credit | The network part of your IP address (for example 203.0.113.0/24) stored with the credit | To limit welcome credit per network and stop abuse | Legitimate interests |
| Payments | Your Stripe customer reference, top-up amounts, dates, payment status, and the name and billing address you give at checkout | To add credit and keep accounting records | Contract and legal obligation |
| Usage records | For each request: the model, the number of tokens, the cost, how long it took, the result status, and which API key was used | To charge for usage, show you your usage, and prevent abuse | Contract and legitimate interests |
| Product events | A small set of account events, such as that you ran out of credit or started a checkout, and how you first reached the site (referring site and campaign tags). Never prompts or replies. | To see where people get stuck and improve the product | Legitimate interests |
| API keys | A one-way hash of each key, its first characters, its name, and when it was last used | To check keys and show them to you | Contract |
| Emails | The emails we send you, such as sign-in links and low-balance alerts, and messages you send to support | To run the service and answer you | Contract and legitimate interests |
| Product update emails | Your email address and your choice, with when and where you made it | To send news and offers about unrestricted.sh to people who asked for them, or who were told at sign-up or at checkout and did not decline | Consent, or for customers our legitimate interest in telling them about similar services (Danish Marketing Practices Act §10(2)) |
| Website analytics | Pages visited, referring site, browser, operating system, device type, country, and actions on the public pages, such as submitting the sign-in form, without cookies and without storing your IP address | To understand how the website is used | Legitimate interests |
What we do not collect
- Prompts and answers. Requests pass through Cloudflare's network, our servers and our GPU providers only to generate the reply, and we do not save or log them. To answer follow-up requests faster, the GPU server keeps recent context in its memory until newer requests replace it or the server shuts down. It is never written to disk and is not linked to your account.
- Chat history. The playground stores your conversations in your browser, encrypted with a key tied to your account. They are not sent to our servers.
- Card details. Payment details are handled by Stripe and Link; we never see your full card number.
Cookies and browser storage
We use only what the service needs to work:
- a session cookie that keeps you signed in,
- a cookie that remembers which sign-in method you used last, so the sign-in page can point to it,
- a cookie that remembers whether the navigation sidebar is open,
- browser storage for your encrypted chat history, when chat history is turned on,
- browser storage for a message you typed but did not send because you went to add credit, kept for up to 24 hours so you can send it afterwards.
Our analytics does not use cookies. We use no advertising or cross-site tracking cookies.
Who we share data with
We use these providers to run the service. They process data on our behalf and only for that purpose:
| Provider | What they do | Where |
|---|---|---|
| Render | Hosts the website and API | Frankfurt, Germany |
| Database host | Stores account, billing, and usage data | Germany |
| RunPod | Runs the models on GPUs; your prompts are processed there to generate the reply | Iceland, Norway and Sweden |
| Vast.ai | Rents us the GPU server that runs the models first; your prompts are processed there to generate the reply | Slovenia (EU) |
| Resend | Sends our emails | European Union |
| Cloudflare | Runs the bot check (Turnstile) on the sign-in form and routes API traffic to our servers through its network | Global network |
| Hosts our support mailbox | Global network | |
| Vercel | Hosts our self-hosted analytics (Umami) | United States |
Stripe and Link process your payment as the merchant of record. They act as independent controllers of payment data under their own privacy policies.
Google and GitHub sign you in when you choose them. They act as independent controllers under their own privacy policies. From them we keep only your account ID, name and email address, and we store their sign-in tokens encrypted.
We share data with authorities only when the law requires it, or when it is needed to protect people from serious harm.
Transfers outside the EU
Some providers are based in, or process data in, countries outside the European Economic Area.
- United States: Render, RunPod, Vast.ai, Resend, Cloudflare, Google and Vercel are US companies, even where they process data in Europe. Transfers to US providers rely on the EU–US Data Privacy Framework, where the provider is certified, or on the European Commission's standard contractual clauses.
How long we keep data
- Account data, sign-in records, usage records, product events, and API key data: for as long as your account exists. When you delete your account, or ask us to, we remove this data right away, and within 30 days at the latest.
- An address typed into the sign-in form that does not complete sign-in: deleted within 24 hours.
- Payment and accounting records: 5 years from the end of the financial year, as the Danish Bookkeeping Act requires. After an account is deleted they are kept without the name or email address.
- Technical logs at our hosting and network providers, such as IP addresses and request paths: a short period, for operating and securing the service.
- Analytics: stored without your email address, account id or IP address.
We keep your email choice while your account exists.
Access by our team
To give support and investigate abuse, our administrators can see account details, balances, payments, and usage records, and can view the site as a specific user. Administrators cannot see your prompts, the answers, or your chat history, because we do not have them. Administrative actions are logged.
Your rights
Under the GDPR you have the right to:
- access your data,
- have it corrected or deleted,
- restrict or object to its processing,
- receive a copy of it in a portable format.
To use these rights, email support@unrestricted.sh from the address on your account. We answer within one month.
You can object to marketing email at any time, free of charge: use the unsubscribe link in any such email, the switch on the Account page, or email us.
You can also complain to the Danish Data Protection Agency, Datatilsynet.
Children
The service is not for anyone under 18, and we do not knowingly collect data about children.
Changes to this policy
We will post any changes here and update the date at the top. We will email you about significant changes.