# How we prove no logs Source: https://redbeard.live/verify/ (this is the markdown copy of that page; the page itself is the reference) Provable privacy # Don't trust us. Check. Everyone says “we don't keep your data.” Here's how you can actually tell the difference with RedBeard. In plain words first, then the full technical detail. In plain words ## We never write your conversations down. ### Like a call with no recorder RedBeard sends your words to Sherlock, running on GPU infrastructure we manage, and streams the answer back. Our gateway and model service do not save the conversation. ### We only keep a tally We count how much you've used, so your plan's limits work, and how busy the whole service is each hour, with no key attached. It's like a gym counting visits without filming anyone. ### You don't have to believe us The code that runs RedBeard is out in the open, so anyone who can read code can confirm it never saves what you type. ## What happens to your message. You send a message Gateway checks your key Sherlock runs on our GPU server You get the reply Two counters +1 your key's tally, and the hour's total for the whole service (no key). Nothing else is written. Your words never stored by our gateway or model service. ## Everything we keep. The whole list. Our key database has exactly two tables, and one separate file of hourly totals. None of them has a place to put your messages. ### Keys - a fingerprint of your key (not the key itself) - your plan and how much you've used - when your access runs out - your prepaid balance and how much has been paid onto the key in total ### Orders - a payment reference and amount - whether it's paid - no name, no email, no address ### Hourly totals - one row per hour for the whole service - how many replies, how long, how fast - how many app downloads started, per file - no key, no fingerprint, no words, no address ### Conversations There is no such table. We have nowhere to put your prompts or the AI's replies. They never touch our disk. The technical part ## How it actually works. ### The path a request takes Your request hits the gateway. It checks your key's fingerprint and remaining allowance (a read of the `keys` table), forwards your messages over a private connection to Sherlock on our rented GPU server, and streams the reply back. When the reply finishes, we update your key's usage counters and the service's anonymous hourly totals. Neither our gateway nor our model service persists your prompt or answer. ### What's in the database, exactly Two tables and nothing else: `keys` (key hash, plan, usage counters, paid-until, prepaid balance, total paid) and `orders` (order id, key hash, payment reference, amount, status; deleted a day after payment, or a week after an unpaid order was made). There is no column anywhere for message content. Our own test suite asserts this: it sends a conversation through, then checks that the text appears in no table. One separate file, `stats.db`, keeps hourly totals so we know when the service is busy and whether it is fast enough: one row per hour, per plan, per route (website or API), holding only counts and sums (replies, tokens, seconds, limits reached, searches, tries while Sherlock was offline). The same file counts app downloads: one row per hour and file name, holding only the count; the download link passes through the gateway for that and goes straight on to the file. It has no column for a key, a fingerprint, an address or any text, and the test suite checks that a conversation's words and the key's fingerprint appear in none of its rows. Rows older than about 13 months are deleted. The honest limit: while we have few customers, a quiet hour's total may be one person's activity, though it never says whose. ### How you verify it A privacy policy is a promise. Source code is checkable. The gateway's full source is [public on GitHub](https://github.com/fitattention/redbeard-gateway), so you can read these guarantees for yourself and confirm that no request body is ever written to storage. ### The honest limit The computer running Sherlock has to read your words to answer. We operate the model service on rented GPU infrastructure, whose hosting operator controls the underlying machine. Our public gateway source lets you inspect its storage behaviour; it cannot independently prove which code is running or the hosting operator's practices. We do not claim cryptographically verified end-to-end zero retention. ### Why we don't just encrypt the logs Because encrypting your conversations means we'd be keeping them, in a locked box, and holding the key. Storing nothing is strictly stronger than storing a locked box we can open. The goal isn't a better lock. It's having nothing to lock up. Questions about any of this? It's all in the [docs](https://redbeard.live/docs/#privacy), and in the [open source](https://github.com/fitattention/redbeard-gateway).