Law Enforcement & Data Request Guidelines
We comply with valid legal process. Full stop. We do not volunteer data, we do not respond to informal asks, and we do not collect data "just in case" it is ever requested. Because the service is architecturally no-logs, the answer to most content requests is not a refusal — it's an empty set.
What we require, by data tier
| Requested data | Minimum process |
|---|---|
| Basic account records (email, signup date, credit totals) | Jurisdictionally valid subpoena |
| Transaction metadata (per-request model name, token counts, timestamps; authentication/access log entries within their retention window) | Court order (18 U.S.C. § 2703(d) or equivalent) |
| Content of prompts or completions | Search warrant on probable cause — and none exists; see below |
Foreign requests must come through applicable MLAT or letters rogatory unless clearly permitted by both our law and yours.
What exists to hand over
- Account email and creation date
- Credit ledger totals and top-up events (payment-processor reference IDs)
- Per-request metering: model name, token counts, cost, timestamp (numbers only)
- Hashed API keys and labels (a hash identifies a key; it does not reconstruct one)
- Authentication and access log entries (IP address, user agent, timestamp) for as long as our hosting providers retain them (currently up to 30 days)
We do not possess: prompt or completion content, conversation histories, or usage content of any kind. Our database schema has no column that holds them and the gateway's content logging is disabled. A warrant for content is answered with an affidavit describing this architecture.
What we will do
- Verify jurisdiction, validity, and scope of every request before any disclosure.
- Narrow or challenge overbroad requests through counsel where grounds exist.
- Notify the affected user before disclosure whenever the law permits, and publish a delayed notice after any gag period expires.
- Publish an annual transparency note: requests received, complied with, challenged, and the categories involved.
- Disclose without process only where the law compels it (e.g., NCMEC reporting obligations) or where we reasonably believe someone's life is at imminent risk.
Contact
legal@cheapweights.ai. Requests on letterhead, with case number and the specific legal instrument. We do not accept service by support ticket, DM, or phone.