I had Zero Data Retention enabled for all models I use through Openrouter. I was sure I was safe from my data being saved - if I tried to use a model with no ZDR guarantees, Openrouter would just return an error code through the API. This is how I had my guardrails configured.
On October 16 I used the Openrouter site when logged in and I noticed a banner about new Safety Retention features for Google models. I thought "hm, good thing they notified me but I'm sure the effect for me will be I will just stop being able to use the Google models". I still went to the privacy settings to double check. I was shocked to find that my privacy settings had been automatically changed to allow Privacy Retention on Google models (other models still require ZDR according to my settings).
The Privacy Retention goes live on October 18.
Imagine using Openrouter for a client and missing this announcement and this date, thinking all data going through Openrouter is still ZDR-only.
I was unable to find a link to an announcement or a documentation page describing these changes. The announcement banner and the (logged-in) privacy page are the only sources of information about this I am seeing as of now.
It's backed by legalese in contracts and terms of use, and companies do treat it seriously.
It depends on what's your use case and geopolitics. If a US-based inference provider violates the ZDR agreement for a private Polish citizen like me, my hands are probably tied. But it doesn't mean ZDR policies are a scam overall.
5 comments
[ 6.4 ms ] story [ 55.9 ms ] threadOn October 16 I used the Openrouter site when logged in and I noticed a banner about new Safety Retention features for Google models. I thought "hm, good thing they notified me but I'm sure the effect for me will be I will just stop being able to use the Google models". I still went to the privacy settings to double check. I was shocked to find that my privacy settings had been automatically changed to allow Privacy Retention on Google models (other models still require ZDR according to my settings).
The Privacy Retention goes live on October 18.
Imagine using Openrouter for a client and missing this announcement and this date, thinking all data going through Openrouter is still ZDR-only.
I was unable to find a link to an announcement or a documentation page describing these changes. The announcement banner and the (logged-in) privacy page are the only sources of information about this I am seeing as of now.
My trust in Openrouter took a massive hit today.
They most likely privately store your data anyway, it is probably just a placebo to get you to use OR.
I mean really? Google and Zero Data Retention?
It depends on what's your use case and geopolitics. If a US-based inference provider violates the ZDR agreement for a private Polish citizen like me, my hands are probably tied. But it doesn't mean ZDR policies are a scam overall.