What we collect.
What we never see.

A research instrument, not a platform.

honesty.tools presents research methods, public utilities and selected hosted previews. Browsing the lab and using the public local utilities requires no account. Browser calibration sends model requests directly to the chosen provider. Hosted Photon requests reach our server and may reach configured upstream providers. API-key signup creates a service account and can store an optional email. Review the selected endpoint and configuration before sending sensitive material.

Public artifacts, service accounts and operational metadata.

• Registered certificates. If — and only if — you click register this certificate on the calibrate page, the finished certificate is sent to us and published in the public registry. A certificate contains the model id, the verdict and scores (AUROC, refusal coverage, the null-test result, the fitted probe parameters), the battery version it was run against, the registration time, and up to three sample questions with short answer snippets from the run. The full certificate — including those snippets — is shown to you on screen before you click register, so you see exactly what will become public. Registered certificates are public by design: anyone can view them at /cert/<id> and list them via the API.
• Hosted API accounts. The signup implementation stores a key hash and optional email for the service account. Usage metering and any configured subscription are separate from browser calibration. Payment processing, when selected and configured, uses Stripe; signup alone is not a purchase.
• Minimal operational logs. Like any web server we process request metadata to serve and protect the site: per-IP rate-limit counters (held in memory, not in a database) and standard transient request logs (IP address, path, timestamp) used for abuse prevention and debugging. We don’t build profiles from them.

Browser calibration: your key, prompts and model answers.

The in-browser calibration is client-side by construction. When you paste an API key and run the battery, every model call goes straight from your browser to OpenRouter (or to your own endpoint, if you point it at one). Our server never sees the key, the prompts, or your model’s answers — there is no code path that sends them to us. For this browser-calibration path, the finished certificate reaches us only when you choose to register it. This statement does not cover hosted Photon requests, API-key signup or optional public read receipts.

Don’t take our word for it: open your browser’s network tab while a calibration runs. Every request goes to openrouter.ai (or your own host) — none to honesty.tools until the moment you register.

Hosted requests have a different data path.

The hosted endpoints receive the submitted prompt or claim, process it under the selected route and may forward it to configured upstream model or registry providers. Their handling is separate from direct browser calibration. Public receipt creation and certificate registration intentionally publish the chosen artifact. Operational logging, retention and provider behavior depend on the deployed configuration; this site revision does not establish a new retention guarantee.

Who else touches the traffic.

• Model and registry providers. Browser calibration calls the endpoint you choose, such as OpenRouter, under that provider’s terms. Hosted routes may call configured upstream providers or registries. These are separate paths; review their terms and the chosen route before use.
• Stripe. When a configured paid plan or billing portal is chosen, Stripe processes the payment/account interaction under its own terms. No purchase is required to browse the lab.
• Hosting and edge — the site is served through a content-delivery edge and an origin hosting provider, which process request metadata (such as IP addresses) as part of delivering traffic, as is standard for any website.

The site-source review identifies these integration categories. It does not audit every runtime logging, retention or third-party configuration.

Opt in is the default off.

• Browser calibration without registration. You can run a full calibration, read the certificate, and download the JSON — and our server keeps nothing.
• Minted read receipts — you ask, we store. Prism questions are not stored by default. If you click share or download the card on a read’s certificate, the button says — before you click — that it mints a signed receipt: the question and the lens’s reading are re-computed on our server, ed25519-signed, and stored at a public permalink (/read/<id>) so the shared artifact stays verifiable. That public mint is opt-in. Hosted processing and operational logs have their own configuration and should not be inferred from this public-sharing choice.
• Takedown. If a certificate or a minted read receipt concerns you — it’s yours and you’ve changed your mind, or it misrepresents a model you’re responsible for — email hello@honesty.tools with the id (the part after /cert/ or /read/) and we’ll review and remove it.

Dated, on this page.

If our practices change, this page changes with them, with the date at the top updated. There is no silent-update mechanism — this page is the record.