We track nothing. Nothing.

version 1.0 · effective 2026-10-16

The whole policy in one line: venom.st doesn't log, store, analyze, sell, correlate, fingerprint, profile, or share anything you do here. We can't hand over what we don't have.

What we don't collect

Item	Status
IP addresses	not stored
Browser fingerprints / user-agent	not stored
Email, name, phone, address	never asked for
Chat history (prompts, replies)	not stored on server
Tool-run results	not stored on server
Uploaded files	processed, discarded
Cookies for tracking / analytics	zero
Google Analytics / Meta Pixel / etc.	none
Session recordings	never
Access logs beyond what nginx needs to serve the response	discarded on rotation

What exists at all

Your token

Your operator token is generated client-side in your browser via crypto.getRandomValues. We never see the token in plaintext — your browser derives an authentication proof from it before any request leaves your machine. If you lose the token, we have no way to recover it. That's by design.

Your conversation history

Chat history lives in your browser's localStorage, scoped to your device. It never leaves. Clear your browser data and it's gone forever — including from us, because we never had it.

Transport

Everything over TLS 1.3 to venom.st. The underlying backend (model inference, tool execution) runs in-process on a dedicated node — no third-party AI vendor sees your prompts.

Tor + source tools

Tor-routed calls (web search, source fetch) run through a local tor daemon on our node. Your IP never touches the source endpoints you query. We don't retain the queries, the results, or the circuit metadata.

Third parties

We don't share data with third parties because we don't have data to share. The upstream services we query on your behalf (public breach indexes, abuse.ch feeds, nvd, etc.) see our server's IP, never yours. Those services' own privacy policies apply to what they do with the query strings.

Encryption

In transit: TLS 1.3 end-to-end between your browser and the node.
Account state: There is no account state to encrypt. Your token is the account.
Server disk: No PII, no chat content, nothing to encrypt because nothing is persisted.

Access by us

We — the people running venom.st — have no technical means to read your chats, see your prompts, recover your token, or correlate requests to a human. We can see aggregate load on the box (CPU, memory) and that's it. The architecture isn't "we promise not to look," it's "there's nothing to look at."

Legal demands

If a government or law enforcement agency serves us a warrant for your data, we will comply with the law by handing them what we have. What we have is: nothing. There is no account record, no IP log, no chat history, no payment record (venom.st doesn't charge), no email on file. A subpoena returns an empty folder.

Children

venom.st is not intended for anyone under 18. We don't ask for your age because we don't ask for anything. Please don't use the service if you're under 18.

Changes

If this policy changes, the new version replaces this one at venom.st/privacy with a bumped version number and date. We'll announce material changes on the landing page before they take effect.

Contact

Questions, complaints, security disclosures: find us on Telegram. We don't publish an email because we don't want you to send one that creates a paper trail with your email provider.