Privacy Policy

wangram.com is a pay-as-you-go comparison tool for frontier AI models. This policy explains what data we collect when you sign up, run a query, or buy coins — and how you can exercise your rights under the GDPR.

• Account data — Email, hashed password (never the plaintext), optional display name, chosen voice, chosen response language, coin balance, and account creation time.
• Search data — The text of every query you submit, any image you attach, the responses from each model, latency and success/failure per model, and which model (if any) you pin as the best answer.
• Payment data — We do NOT store your card number. Polar.sh processes payments and returns only the session id, amount, and status, which we log for accounting.
• Technical data — IP address of your API calls (in server logs, typically for 14 days), user-agent string, and standard access logs required to run the service.

We use only strictly-necessary storage — no advertising or analytics cookies. When you click Accept or Decline on the banner, we save your choice in a single localStorage entry so we don't ask again.

• access_token / session_token — HTTP-only cookies containing your signed session. Deleted when you sign out.
• pq_token / pq_lang / pq_cookie_consent — Local browser storage for your JWT fallback, preferred language, and cookie-banner decision. Cleared on logout or if you clear site data.

We share the minimum needed with the following processors to deliver the service you asked for:

• OpenRouter — Your query text and any attached image are sent to OpenRouter, which forwards them to the five model providers (OpenAI, Anthropic, Google, xAI, DeepSeek).
• Polar.sh — Payment processing. Polar.sh receives your card details directly; we only see the session ID and status.
• OpenAI (Whisper / TTS) — If you use voice input we send the audio blob to OpenAI Whisper; if you play the answer aloud we send the text to OpenAI TTS.
• Google (OAuth) — If you sign in with Google we receive your email, name, and profile picture from Google. We do not receive your Google password.

We rely on (a) performance of a contract — we can't run a search without sending your query to the model providers; (b) legitimate interest — server logs and fraud prevention; and (c) your consent — anything beyond strictly-necessary storage, which is currently nothing.

Account and search data are retained until you delete your account (Profile → Danger zone → Delete account). Server access logs are typically rotated after 14 days. Polar.sh payment records are retained for 7 years to comply with tax law.

You can access, correct, or delete your data at any time from your Profile page. To exercise the right to portability or to object to processing, email us at the address below and we'll respond within 30 days.

Data controller: PrismQuery. Email us at privacy@prismquery.dev for any request, complaint, or question about this policy. You also have the right to lodge a complaint with your local data protection authority.