Privacy

Last updated: 2026-08-06

This service, dsgate, is a free keyless proxy to the DeepSeek API, run by the open-source project thevibeworks/deepseek-cli. There is no account system, so most of what a privacy policy usually has to explain simply does not exist here. This page lists exactly what is recorded, exactly what is not, and what leaves this machine for DeepSeek. Every claim on this page corresponds to code you can read in the repository.

What we record

Every billable request appends one line to an accounting journal. That line contains, in full:

• a timestamp (UTC)
• an anonymous subject id: 16 random bytes minted by your own machine, tied to nothing about you
• the endpoint name (for example chat) and the model
• token counts: input, cache-hit, and output
• the cost in USD, and a flag when that cost was a defensive estimate rather than a measurement

That is the complete record. The journal exists because this is a shared credit pool spending real money, and the budget needs a memory. It contains nothing that identifies a person.

What we do not record

The gateway never stores or logs prompts, completions, IP addresses, or request headers. This is not a configuration choice that could be flipped; the journal has no field for any of them, and the statistics code is written so that no function in it accepts an IP address at all. The nginx in front of the gateway runs with access_log off, so there is no web-server log holding IPs either. Prompt logging was deliberately never built, not even behind a debug flag, on the reasoning that a flag that can log prompts is a flag that eventually will.

One narrow exception, stated precisely: the enrolment endpoint counts how many proof-of-work challenges it has issued per address bucket during the current UTC day, so that difficulty can escalate against identity farming. That count resets at midnight, is never written to the journal, and is never joined to a token or a request.

What leaves for DeepSeek

Your prompt does not stay on your machine. It transits this gateway and is forwarded to api.deepseek.com, where it is processed under DeepSeek's own terms of service and privacy practices. We pass the bytes through and do not keep them, but DeepSeek receives them the same as if you had called the API yourself. Do not send anything sensitive through this service. For sensitive work, bring your own key from platform.deepseek.com and skip the proxy entirely.

Each forwarded request carries your anonymous subject id as DeepSeek's user_id field. This is the mechanism DeepSeek provides for one account fronting many users: it attributes content-safety events to the individual subject rather than the whole pool, and it keeps each subject's prompt cache isolated from strangers'.

Geography

The dashboard shows where traffic comes from as a per-country histogram. The input is a two-letter country code supplied by the network edge; no IP address ever reaches the code that counts it. The histogram is aggregate only, is never linked to a subject, lives in memory, and is lost whenever the gateway restarts. A country total is a fact about the service, not about a person.

Cookies and local storage

This site sets no cookies. It stores one value in your browser's localStorage: your light-or-dark theme preference. The CLI stores your free-tier token in your own configuration directory on your own machine; it is never held server-side, because the server has no user table to hold it in.

Retention

Journal files are the financial record of the shared pool and are retained; since they contain only the fields listed above, retaining them retains nothing personal. Live dashboard statistics are kept in memory only and vanish on restart. Per-address enrolment counts last one UTC day. Tokens themselves expire seven days after they are minted.

How to be forgotten

Run deepseek free off. That deletes the token from your machine, which is the only place it exists. On the server side there is nothing to delete that points at you: a subject id is 16 random bytes with no name, email, or address attached, so we could not look up "your" journal entries even if you asked us to. Any token you abandon stops working within seven days regardless.

What we could see but choose not to

Honesty requires saying this plainly. A proxy necessarily has your prompt in memory while it forwards it, sees the IP address of the connection, and sees your headers. We could log all of it. We record none of it, and the code is public so that this is a checkable claim rather than a promise: read internal/quota/quota.go and internal/stats/stats.go in the repository and confirm there is nowhere for that data to go. What you should trust is the code, not this page.

Contact

This is a hobby service run by maintainers of an open-source project, not a company, and there is no data-protection office. Questions and requests go to the GitHub issue tracker.