privacy & terms

Last updated: 2026-09 · applies to frugalplugin.com and api.frugalplugin.com

What leaves your machine — and when

Frugal is local-first. Most prompts are classified by heuristics on your machine and never touch the network. A hosted verdict call happens only when a prompt is ambiguous and your install is licensed.

A verdict call to api.frugalplugin.com/v1/route carries:

• prompt head (≤800 chars) and tail (≤400 chars) — scrubbed for keys, tokens and passwords before leaving your machine
• prompt length and heuristic signal counts (numbers, not text)
• recent-prompt heads (≤80 chars each, scrubbed) for context
• a machine fingerprint — a non-reversible hash of hostname, user and arch
• your license key (sent as a bearer token)

Never sent: full prompt text, file contents, code, or paths.

Consent levels — frugal consent

• metadata (default) — verdict counts, tiers and latency in analytics. No prompt text is retained.
• contribute — also retains scrubbed excerpt→verdict pairs to improve the router. Thank you.
• none — usage events are skipped entirely; nothing is retained beyond serving the request. (The verdict call itself still carries the truncated excerpt — it is required for classification.)

What we store

• License record — key hash (raw keys are not stored and cannot be recovered — only reissued), email, plan, seats, bound machine fingerprints.
• Caches — license lookups (5 min), verdict cache (1 hr), rate-limit counters. All expire automatically.
• Usage analytics — counts, latency, tier per request (truncated license/machine hashes; no prompt text). Skipped at consent none.
• Corpus — scrubbed excerpt→verdict pairs, only at consent contribute. Kept at most 90 days.
• Delivery records — the checkout success page reads a delivery row holding your raw key; these expire after 30 days.

What stays on your machine

~/.config/frugal holds your routing log, config and license file — none of it is uploaded. frugal uninstall --all removes the binary, harness wiring, the daemon and all local state.

Third parties

• Stripe — payment processing. We receive your email and amount, never card details.
• Jev classifier (api.typesafe.ai) — receives the truncated, scrubbed excerpt for ambiguous prompts.
• Cloudflare — hosting (Pages, Workers, D1, KV, Analytics Engine).
• Resend — license-key delivery email, when configured.

Terms

• Beta software, provided as-is. Routing advice is advisory — your tools remain in charge of execution.
• License keys are per-seat; a team key covers the seats purchased.
• Refunds within 14 days of purchase — email [email protected].

Questions: [email protected] · ← frugal