Privacy.

Last updated October 7, 2026

This covers megachadcua.com and the megachad cua API, run by Tzafon Inc. Short version: we keep what we need to run and bill the service, we don't sell anything, and there are no ad trackers.

What we collect

Account: your email and a salted hash of your password. API key: stored hashed for checking requests, plus an encrypted copy so the console can show it to you. Usage: session IDs, start and end times, durations, and billed credits. Payments: handled by Stripe. We never see your full card number. Security: IP addresses of sign-in and demo requests, kept up to 24 hours for rate limiting. Fonts: pages load fonts from Google Fonts, which sees your IP address when it serves them.

What you send to the API

Audio, text and schemas you send pass through our gateway to our model servers to produce decisions. The gateway doesn't store them. Our model servers process them to answer and may keep short-lived operational logs for debugging. We don't sell this data or share it with advertisers.

Cookies

One cookie, to keep you signed in. No analytics or ad cookies.

Who else touches data

Cloudflare hosts the site and API, and sends our account emails (a welcome note when you sign up, and password-reset links you ask for). We don't send marketing email. Stripe processes payments. Our model runs on GPU servers we operate.

Your choices

Email hello@megachadcua.com to get a copy of your data or to delete your account. We'll act within 30 days. Billing records we're required to keep for tax purposes are kept as long as the law requires.

Changes

We'll update the date above when this changes, and email you about material changes.