Overview
ModelBank (modelbank.ai, “we”) is a public website about AI model status, prices and deprecations. We collect as little as possible: browsing needs no account, and alerts can be used without one. This policy explains what we collect, why, and how you control it.
What we collect
Account data: if you sign up, your email, display name, avatar URL and a salted hash of your password (we never see your plain-text password).
Social sign-in: with GitHub or Google we receive only your account ID, email, name and avatar. We do not access repositories, contacts or other data, and we do not store the provider’s access token.
Alert channels: browser push subscription endpoints and encryption keys, chat webhook URLs you enter, and the topics you follow.
Security & abuse prevention: login sessions, a one-way hashed IP digest (used for rate limiting, cannot be reversed), and your browser’s user agent.
Content you submit, e.g. “I’m having problems too” reports (service, time and an anonymous digest only).
How we use it
To provide sign-in and subscription management; to send the outage, recovery, price and deprecation alerts you choose; to send account emails (verification, password reset); and to prevent abuse.
We do not sell your data, use it for ad targeting, or share it with third parties except where required by law.
Cookies
We use only essential cookies: a session cookie (HttpOnly, 30 days), a “signed in” hint cookie, a 10-minute security cookie during social sign-in, and a cookie that remembers the language you picked (1 year; plus a 1-minute hint cookie when you are switched to the Chinese version automatically). Your language preference, time-zone choice (only when you pick UTC or Beijing), recently viewed items and on-device subscriptions are kept in your browser’s local storage. No advertising or cross-site tracking cookies.
Service providers
Hosting and database: a global cloud provider (CDN, edge compute and database). Social sign-in: GitHub and Google. Browser push is delivered through your browser vendor’s push service (e.g. Google FCM, Mozilla, Apple). Chat alerts go to the platform you configure (Slack, Discord, Feishu, DingTalk, WeCom, …). Account emails may be sent via Brevo.
Model check and API keys
In manual checks, the prompts and the replies you paste are processed only in your browser and never uploaded. Unfinished replies are kept only temporarily in the current tab (cleared when the tab closes, expiring after 2 hours) and are removed as soon as a check completes.
The API check runs in your browser: the API key you enter is used only for that check and sent directly to the endpoint you entered. If the endpoint blocks browser requests, the request is relayed unchanged by our relay, which never stores or logs keys, request content or answers; it only applies per-IP rate limits.
Only if you turn on “Remember key” is the key saved, in your own browser’s local storage, and you can turn it off and clear it at any time. When you create a share link we store only the result, without the key, prompts or answers (showing the endpoint domain is your choice), plus a preview image showing only the verdict and ranking, kept in our object storage for link previews on social platforms and deleted with the report after 180 days.
Usage count: each time a check finishes (or an API check fails), your browser sends one anonymous count containing only the check type (quick / precise / API) and the verdict (e.g. “Consistent”, “Suspicious”), used to measure usage and improve the check. It contains no model name, endpoint, key, prompts or replies, and uses no cookies.
Only check keys and endpoints you are authorised to use, and consider rotating the key afterwards.
Saved checks for signed-in users: every check you finish while signed in is saved to your account automatically (you can turn this off in account settings). What is saved matches a shared report — the verdict, the identified model and an evidence summary, plus the endpoint domain for API checks; API keys, prompts and the replies you paste are never saved. Records are visible only to you; you can add notes, delete single records or clear them all at any time, and they are deleted with your account. Each account keeps the latest 200. To handle abuse, security issues and improve detection accuracy, site administrators may review these records when needed, and every review is logged. Nothing is saved if you are not signed in.
Results are statistical consistency judgements for reference only and are not a finding of fact, an accusation against any provider, or legal evidence. If you share a result, keep it factual; you are responsible for what you share.
AI assistant and feedback
Messages you send to the AI assistant are sent to our servers to generate answers; the conversation is kept only in your browser’s session storage.
When you submit feedback through the assistant, we store the message, the relevant part of the conversation, screenshots you upload, the page you were on, contact details you choose to leave and a hashed IP address, to handle the issue, reply to you and prevent abuse; our operators are notified by email. Screenshots are kept in our cloud storage and are visible to administrators only.
Please do not include API keys, passwords or other secrets in feedback or screenshots. Deletion requests: [email protected].
Retention & deletion
You can delete your account at any time under Settings; your account, sign-in methods, sessions and linked subscriptions are removed immediately. Delivery logs are kept for 30 days and alert records for 90 days; broken push channels are cleaned up automatically.
You can remove any alert channel at any time from the alert panel or your account, or disable notifications for this site in your browser.
Security
HTTPS everywhere; passwords hashed with salted PBKDF2-SHA256; only hashes of session tokens are stored; rate-limited sign-in and sign-up; the admin area has multiple layers of access control.
Children
This site is intended for developers and professionals and is not directed at children under 13.
Changes & contact
If we update this policy we will change the date at the top. Questions or deletion requests: [email protected].