Privacy
What Lineage API stores about you, who else handles it, and how long it is kept.
Draft for review. Rex has not approved this page yet, and it may change before the API launches.
Last updated November 1, 2026
When you sign in
Sign-in uses Auth.js with GitHub or Google. Sessions are stored in the database, not in the cookie. Lineage stores:
- Your user record: the name, email address and profile image link that GitHub or Google sends, and when the email was verified if the provider says so.
- A linked account record: which provider you used, your account id there, and the tokens the provider returns at sign-in (access token, refresh token, ID token, their expiry, scope and token type).
- A session record: a random session token, your user id, and when the session expires. Your browser keeps a cookie with that session token. Signing out deletes the session.
Lineage does not ask for or store a password.
API keys
For each key, Lineage stores the SHA-256 hash of the full key, its first 16 characters, the name you gave it, its rate limit and credit limit, whether it is a live or test key, and when it was created, last used and revoked. The full key is never stored.
Last used is written at most once a minute. Request counts for the rate limit are kept in server memory for the current minute and are not written to the database.
Credits
The credit ledger holds one row for each change to a balance: your user id, the amount in credits, which app made it (lineage or lineage-api), the kind of change (grant, debit, refund, dispute, hold or release), the related Stripe event, charge and payment ids when there is a payment, the key id when a key spent it, a short note, and the time.
Rows are only added, never edited or deleted. Your balance is the sum of your rows. The ledger is designed to be shared with the Lineage consumer app, so one balance covers both.
Payments are handled by Stripe when enabled. Stripe is not live. When it is, card details go to Stripe's checkout page and are never sent to Lineage. Lineage records each Stripe event id, type and outcome so the same payment is never credited twice.
Research queries
There is no search endpoint yet, so Lineage receives and stores no research queries today.
Once search ships, the text of a query is sent to OpenRouter, which passes it to the model provider that runs the search. Requests to archives will go to the public sources in the registry and will identify Lineage, not you.
Lineage does not train models on your queries. The data policies of the model providers reached through OpenRouter are their own.
Living people
Lineage is built to hold as little about living people as it can. A person is treated as not living only when a death date is on record, or when a known birth was more than 110 years ago. Everyone else, including anyone with no dates at all, is treated as living. Requests about a living person are refused before any work starts. Once records are returned, living relatives found in a record will be removed first.
Contact requests
Contact requests are drafts you send yourself. Lineage never sends mail, so an archive only sees what you choose to send. Contact requests are not built yet, and none are stored.
Who handles your data
- Vercel hosts the site and runs the API.
- Neon runs the Postgres database that holds accounts, sessions, keys and the ledger.
- GitHub and Google handle sign-in when you choose them.
- Stripe will handle payments when enabled. It is not live.
- OpenRouter will receive research queries once search ships.
The site loads its fonts from its own files. It runs no analytics or advertising scripts.
How long data is kept
No retention job exists yet. Nothing deletes old rows on a schedule, so accounts, linked accounts, keys and ledger rows are kept until they are removed by hand. Revoking a key marks it revoked; the row stays. Signing out deletes that session.
Retention periods for accounts, sessions, sign-in tokens and future search logs: not decided, and not yet enforced. This page will state them when they are set.
You cannot delete your account from the settings page yet. To ask for deletion, write to [placeholder: contact address not set yet]. Ledger rows tied to a payment may need to be kept for payment records.
Contact
Privacy questions: [placeholder: contact address not set yet].