Last updated: 2026-11-05
This notice covers System Duo at app.vllm-sr.ai, its DeepSeek Harness demo at dsh.vllm-sr.ai, and the same APIs at decision.vllm-sr.ai (System One), mom.vllm-sr.ai and pytorch.vllm-sr.ai (System Two). Where the two systems differ, it says which one does what.
The free APIs are for research and evaluation only; commercial use is not permitted. By creating a key, or by using the service or the demo, you accept this notice and the terms of use.
1. What we collect
- Requests and responses, including images and videos.
- Operational metadata of every request: time, key, model (on System Two also the routing decision that served it), request and response sizes, token counts, latency, status and request ID. System Two’s router also keeps its own routing records (the decision and model of a request, without personal data) for up to 7 days.
- IP addresses, to prevent abuse and to limit how many keys one network creates.
- Keys: a hash of each key (the key itself is never stored), its first characters for display, its label if it has one, whether it is active, when it was created and last used, its usage counts, and the IP address that created it (kept up to 30 days).
This website sets strictly necessary cookies only: one lets this browser list and manage the keys it created, and if you bring older System Two keys over from mom.vllm-sr.ai, a second one does the same for those keys. They do nothing else and are not used for tracking; each is removed with the key’s data or when you clear your browser’s cookies. The DeepSeek Harness demo sets one more, __Host-dsh-demo: a random id that ties your browser to its own sandbox, for a day at most. The site loads no analytics, third-party scripts or fonts, and a key you create is never saved in your browser.
The DeepSeek Harness demo (the third tab of Try it) gives each visitor a sandbox of their own, on that visitor’s own free API key: the one Try it creates when you start the demo, or the one already at the top of the page. What you type there, and what the agent reads and writes in the sandbox, goes to System One and System Two with your key. Those requests are logged like any other request with that key and used in the same ways (section 2), including to train and evaluate models, and they are deleted with the key’s data (section 5). The demo’s gate holds your key in memory only, for as long as your sandbox runs, and adds it to your sandbox’s requests to System Duo; the sandbox never sees it, and nothing in the demo stores or logs it. The sandbox, with your conversations and files in it, is deleted when it ends: after 15 minutes without use, or an hour in all. The demo keeps no other copy, and its own logs keep no IP address, cookie or key.
2. How we use it
Logged data is stored and processed to operate, secure, debug, analyse and improve the service, including how System Two routes requests, and to train and evaluate models. No request header turns logging off.
We sanitise text before analysis where feasible, to reduce sensitive or identifying content; this is not a guarantee that all sensitive information is removed. System Two also replaces credentials and secret-shaped strings (API keys, tokens, private keys) when it logs a request. De-identified data derived from requests, such as sanitised requests and responses and usage statistics, may be published or open-sourced. The status page shows aggregated numbers only.
3. Sensitive data
Do not send sensitive personal information, such as health data, financial or government identifiers, passwords or other credentials, or data about children; nor confidential or regulated data, or data you are not authorised to process. Do not paste any personal data into the DeepSeek Harness demo (above).
4. How long we keep it
- IP addresses: up to 30 days (System Two deletes them after 22 days).
- Requests, responses, media and metadata: as long as they serve the purposes above, or until you delete them.
- System Two’s per-key usage counts shown on the Keys page: 40 days.
5. Revoking a key and deleting your data
Delete key and its data, on the Keys page, or POST /api/keys/self/forget with the key (POST /pt/api/keys/self/forget for an older sk-pt- key; see the docs), revokes the key at once. Each system then deletes what it stored for the key:
- System One, within 30 days, backups included: its logged requests and responses, the media only this key sent, and its metadata.
- System Two, at once: its logged requests and responses, its usage records, its label and its place in your browser’s key list. Only a revoked marker (the key’s hash and its dates) remains, so that the key can never work again. Anything written by a request still running at that moment is removed within two days.
From that moment its data is left out of any export.
Revoke key (DELETE /api/keys/self, or DELETE /pt/api/keys/self for an older sk-pt- key) stops the key and keeps its data. A revoked key can no longer ask for deletion with the key itself; it can still be deleted with its data from the Keys page of the browser that created it.
Requests sent to System Two with the workshop key of PyTorch Conference 2026 (one key that the workshop’s attendees share, made before personal keys) are not linked to a person, so they cannot be deleted per person. A lost key cannot be shown again; create a new one.
6. Changes
This notice may change as the service changes. The current version is always on this page.
7. Contact
Questions about this notice go to the vLLM Semantic Router issues on GitHub.